CVE-2022-50998

[CVE catalog]

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jan 1, 2022, 12:00:00 AM UTC

Updated

Aug 25, 2026, 4:16:44 PM UTC

Source

[NVD] · [CVE record]

A flaw was found in Nokogiri, a Ruby gem for parsing XML and HTML documents. This vulnerability arises from issues within its bundled libxml2 library, specifically involving data corruption from entity reference cycles and integer overflows when processing large XML files. A remote attacker could exploit these flaws by providing specially crafted XML input, potentially leading to denial of service or memory corruption within the application. nokogiri: libxml2: Nokogiri: Denial of Service and Memory Corruption via Crafted XML Input This vulnerability is rated as Important because it can lead to denial of service or memory corruption when processing specially crafted XML input. Red Hat products utilizing `rubygem-nokogiri` are affected, making systems susceptible if they handle untrusted XML data. The flaw stems from underlying issues in `libxml2` bundled with Nokogiri, which could be triggered without complex attack vectors. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.