CVE-2022-51000

Analyzed Analyzed - Analysis Complete

Denial of Service in Nokogiri via libxml2 and libxslt

Publication date: 2026-08-25

Last updated on: 2026-09-08

Assigner: VulnCheck

Description

Rejected reason: This CVE ID has been rejected as a duplicate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-08

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-07

NVD

CVE-2022-51000

EUVD

EUVD-2022-56025

Affected Vendors & Products

Vendor	Product	Version / Range
nokogiri	nokogiri	to 1.13.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

Nokogiri before version 1.13.2 includes outdated libxml2 2.9.12 and libxslt 1.1.34 libraries. These versions contain two upstream vulnerabilities: CVE-2021-30560 in libxslt and CVE-2022-23308 in libxml2. The first allows denial-of-service attacks via untrusted XSL stylesheets, while the second may cause denial-of-service, memory disclosure, or code execution when parsing untrusted documents with specific settings.

Detection Guidance

To detect this vulnerability, check the version of Nokogiri and its bundled libraries (libxml2 and libxslt) on your system. Run commands like 'gem list nokogiri' to check Nokogiri version and 'nokogiri -v' for detailed library versions. If using packaged libraries, versions below Nokogiri 1.13.2 with libxml2 < 2.9.13 or libxslt < 1.1.35 are vulnerable.

Impact Analysis

If you use Nokogiri versions below 1.13.2 with packaged libraries, an attacker could exploit these flaws to crash your application, leak sensitive memory, or execute arbitrary code. This is especially risky if your application processes untrusted XML or XSL files.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. The issue involves denial-of-service attacks, memory disclosure, or code execution in XML processing, which are not directly related to data protection requirements under these regulations.

Mitigation Strategies

Upgrade Nokogiri to version 1.13.2 or later. If using packaged libraries, this will automatically update libxml2 to 2.9.13 and libxslt to 1.1.35. Alternatively, recompile older Nokogiri versions against updated external system libraries.

Hi! I’m here to help you understand CVE-2022-51000. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70