CVE-2021-47996 sparklemotion CVE debrief

Who should care

Users of Nokogiri before version 1.11.4, especially those processing crafted XML documents, should be aware of the potential for denial of service, information disclosure, or memory corruption. Organizations using Nokogiri should prioritize updating to version 1.11.4 or later to address multiple vulnerabilities in the bundled libxml2 library. Security teams and vulnerability management teams should review the affected scope, severity, and vendor guidance to validate affected systems and plan for updates or mitigations.

Technical summary

Nokogiri before 1.11.4, when using the CRuby implementation and the packaged libxml2 version 2.9.10, is vulnerable to multiple issues including memory leak (CVE-2019-20388), global buffer over-read (CVE-2020-24977), heap-based buffer overflow (CVE-2021-3517), and out-of-bounds read (CVE-2021-3518). These vulnerabilities were addressed in libxml2 version 2.9.12. The affected product deployments should be reviewed for potential exposure, and owners should be assigned for follow-up. Security teams should validate affected scope, severity, and vendor guidance to plan for updates or mitigations through normal change control. Users processing crafted XML documents are at risk of denial of service, information disclosure, or memory corruption. Updating to Nokogiri version 1.11.4 or later is recommended to address these vulnerabilities.

Defensive priority

Organizations using Nokogiri should prioritize updating to version 1.11.4 or later to address multiple vulnerabilities in the bundled libxml2 library.

Recommended defensive actions

• Update Nokogiri to version 1.11.4 or later
• Review and apply patches for libxml2 vulnerabilities
• Monitor for crafted XML documents that may lead to denial of service, information disclosure, or memory corruption
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The Nokogiri package before version 1.11.4, when using the bundled libxml2 version 2.9.10, is affected by several vulnerabilities including a memory leak, global buffer over-read, heap-based buffer overflow, and out-of-bounds read. These issues were addressed in libxml2 version 2.9.12. Organizations using Nokogiri should prioritize updating to version 1.11.4 or later to address multiple vulnerabilities in the bundled libxml2 library.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.