CVE-2021-47996

[CVE catalog]

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jan 1, 2021, 12:00:00 AM UTC

Updated

Aug 25, 2026, 4:16:42 PM UTC

Source

[NVD] · [CVE record]

A flaw was found in Nokogiri, specifically within its bundled libxml2 library. A remote attacker could exploit multiple vulnerabilities, including memory leaks, buffer over-reads, heap-based buffer overflows, and out-of-bounds reads, by processing specially crafted XML documents. This could lead to memory corruption, information disclosure, or a denial of service. nokogiri: libxml2: Nokogiri: Memory Corruption via Crafted XML Documents Important: Red Hat products utilizing Nokogiri are affected by multiple vulnerabilities in its bundled libxml2 library, which can lead to denial of service, information disclosure, or memory corruption when processing specially crafted XML documents. While Nokogiri's default parse options prevent exponential entity expansion attacks, other flaws remain. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.