CVE-2021-3537: Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-14 · updated 2026-10-14
Weakness: CWE-476

Description

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

Affected products

Debian Linux: 9.0
Fedoraproject Fedora: 33, 34
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
Clustered Data ONTAP: all versions
NetApp Clustered Data Ontap Antivirus Connector: all versions
NetApp Hci H410C Firmware: all versions
NetApp Manageability Software Development Kit: all versions
NetApp ONTAP Select Deploy administration utility: all versions
NetApp Snapdrive: all versions
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
Oracle Corporation MySQL Workbench: through 8.0.26
containers/openjdk: 8-update301
Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
Oracle Real User Experience Insight: 13.4.1.0, 13.5.1.0
Red Hat Enterprise Linux: 6.0, 7.0, 8.0
RedHat Jboss Core Services: all versions
xmlsoft libxml2: before 2.9.11 — fixed in 2.9.11
Rubygems Nokogiri: before 1.11.4; 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+122) — fixed in 1.11.4

How to fix

Upgrade to a fixed version: xmlsoft libxml2 2.9.11; Rubygems Nokogiri 1.11.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3537 or the next vulnerability affects your stack