Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2022-50998

Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 (data corruption / double-free from an entity reference cycle when entity content is allocated from a dict) and CVE-2022-40303 (integer overflows when parsing with XML_PARSE_HUGE). Nokogiri 1.13.9 upgrades the packaged libxml2 to v2.10.3 to address these issues. Processing crafted XML input may lead to denial of service or memory corruption. (The advisory also references CVE-2022-2309, a NULL pointer dereference via iterwalk/canonicalize, which maintainers determined does not affect Nokogiri users.)
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 27.9%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2022-50998


Contact Us

Shodan ® - All rights reserved