CVE-2022-51000
Received Received - Intake

Denial of Service in Nokogiri via libxml2 and libxslt

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via CVE-2022-23308 in libxml2, an application parsing an untrusted document with parse option DTDVALID set to true and NOENT set to false may be vulnerable to denial of service, memory disclosure, or code execution. Nokogiri 1.13.2 upgrades vendored libxml2 to 2.9.13 and libxslt to 1.1.35.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2022-51000
EUVD
EUVD-2022-56025

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sparklemotion nokogiri to 1.13.2 (exc)
gnome libxml2 2.9.12
gnome libxslt 1.1.34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nokogiri before version 1.13.2 includes outdated libxml2 2.9.12 and libxslt 1.1.34 libraries. These versions contain two upstream vulnerabilities: CVE-2021-30560 in libxslt and CVE-2022-23308 in libxml2. The first allows denial-of-service attacks via untrusted XSL stylesheets, while the second may cause denial-of-service, memory disclosure, or code execution when parsing untrusted documents with specific settings.

Detection Guidance

To detect this vulnerability, check the version of Nokogiri and its bundled libraries (libxml2 and libxslt) on your system. Run commands like 'gem list nokogiri' to check Nokogiri version and 'nokogiri -v' for detailed library versions. If using packaged libraries, versions below Nokogiri 1.13.2 with libxml2 < 2.9.13 or libxslt < 1.1.35 are vulnerable.

Impact Analysis

If you use Nokogiri versions below 1.13.2 with packaged libraries, an attacker could exploit these flaws to crash your application, leak sensitive memory, or execute arbitrary code. This is especially risky if your application processes untrusted XML or XSL files.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. The issue involves denial-of-service attacks, memory disclosure, or code execution in XML processing, which are not directly related to data protection requirements under these regulations.

Mitigation Strategies

Upgrade Nokogiri to version 1.13.2 or later. If using packaged libraries, this will automatically update libxml2 to 2.9.13 and libxslt to 1.1.35. Alternatively, recompile older Nokogiri versions against updated external system libraries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-51000. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart