CVE-2021-3517 Nokogiri contains libxml Out-of-bounds Write vulnerability
An attacker can trigger an out-of-bounds read in libxml2 via a crafted file, causing application crashes and potential information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3517?
CVE-2021-3517 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 19 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
Which versions are affected by CVE-2021-3517?
2 open source packages ship an affected version, including nokogiri. It affects 28 products.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | All versions | 1.11.4 |
nokogiri RubyGems | All versions | 1.11.4 |
Products include Debian Debian Linux, Fedoraproject Fedora, Netapp Active Iq Unified Manager, Netapp Clustered Data Ontap, Netapp Clustered Data Ontap Antivirus Connector, Netapp E-Series Santricity Os Controller and 22 more.
How do I fix CVE-2021-3517?
Upgrade nokogiri to 1.11.4 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-3517 being exploited?
There is no known exploitation of CVE-2021-3517 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-3517, DEBIAN-CVE-2021-3517, ECHO-9b11-dcb0-2dc6, GHSA-jw9f-hh49-cvp9, JLSEC-2025-72, UBUNTU-CVE-2021-3517.