CVE-2021-47996: Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12

Severity: medium (CVSS 5.5)
Exploited in the wild: not listed in CISA KEV
Public exploit or detection template: none known
Published: 2021-05-17 · updated 2026-08-27

Description

### Summary Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses: - [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) (Medium severity) - [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) (Medium severity) - [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) (Medium severity) - [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518) (Medium severity) - [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537) (Low severity) - [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541) (Low severity) Note that two additional CVEs were addressed upstream but are not relevant to this release. [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516) via `xmllint` is not present in Nokogiri, and [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595) has been patched in Nokogiri since v1.10.8 (see #1992). Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.11.4`, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements. ### Mitigation Upgrade to Nokogiri `>= 1.11.4`. ### Impact I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete. All information below is sourced from [security.archlinux.org](https://security.archlinux.org), which appears to have the most up-to-date information as of this analysis. #### [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) - **Severity**: Medium - **Type**: Denial of service - **Description**: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4. #### [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595) - **Severity**: Medium - **Type**: Denial of service - **Description**: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5 This has been patched in Nokogiri since v1.10.8 (see #1992). #### [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) - **Severity**: Medium - **Type**: Information disclosure - **Description**: GNOME project libxml2 <= 2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2 Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4. #### [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516) - **Severity**: Medium - **Type**: Arbitrary code execution (no remote vector) - **Description**: A use-after-free security issue was found libxml2 before version 2.9.11 when "xmllint --html --push" is used to process crafted files. - **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230 - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539 Verified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship `xmllint`. #### [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) - **Severity**: Medium - **Type**: Arbitrary code execution - **Description**:

Affected products

Rubygems Nokogiri: before 1.11.4; 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+122) — fixed in 1.11.4

How to fix

Upgrade to a fixed version: Rubygems Nokogiri 1.11.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47996 or the next vulnerability affects your stack