CVE-2022-23476highCWE-252CWE-476

CVE-2022-23476: high-severity vulnerability in sparklemotion nokogiri

Unchecked return value from xmlTextReaderExpand in Nokogiri

Published · Updated

Follow this CVE+ Monitor nokogiri+ Monitor nokogiri

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.8%
In short

Nokogiri fails to properly check if a function succeeds when parsing XML, which can cause the program to crash when processing malformed XML. This is a vulnerability if your application parses untrusted XML data.

Technical detail

CVE-2022-23476 involves improper error handling in Nokogiri's XML::Reader#attribute_hash method, where the return value of xmlTextReaderExpand is not validated, leading to null pointer dereference on malformed markup. The attack vector is via untrusted XML input, with no authentication required; the impact is denial of service through application crash.

Summary generated and translated by AI from the official description.
Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
sparklemotion · nokogiri
Related CVEs — sparklemotion nokogiri

In the same product, most dangerous first.

CVE-2022-24836HIGHInefficient Regular Expression Complexity in NokogiriEPSS 3.5%CVE-2022-29181HIGHImproper Handling of Unexpected Data Type in NokogiriEPSS 3.2%CVE-2021-41098HIGHImproper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyEPSS 1.5%CVE-2020-26247LOWXXE in NokogiriEPSS 1.2%CVE-2026-79770HIGHNokogiri before 1.19.3 ReDoS via CSS selector tokenizerEPSS 0.5%CVE-2026-57435LOWNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`EPSS 0.5%