CVE-2021-3518 Nokogiri Implements libxml2 version vulnerable to use-after-free

High 8.8 Published 18 May 2021 Updated 14 Oct 2026

An attacker can trigger a use-after-free in libxml2 via a crafted file, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-3518?

CVE-2021-3518 is a high-severity use after free vulnerability in Debian Debian Linux, published on 18 May 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

Weakness: CWE-416

Which versions are affected by CVE-2021-3518?

2 open source packages ship an affected version, including nokogiri. It affects 18 products.

Package	Affected	Fixed in
`nokogiri` RubyGems	All versions	`1.11.4`
`nokogiri` RubyGems	All versions	`1.11.4`

Products include Debian Debian Linux, Fedoraproject Fedora, Netapp Active Iq Unified Manager, Netapp Clustered Data Ontap, Netapp Clustered Data Ontap Antivirus Connector, Netapp Hci H410c Firmware and 12 more.

How do I fix CVE-2021-3518?

Upgrade nokogiri to 1.11.4 or later.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2021-3518 being exploited?

There is no known exploitation of CVE-2021-3518 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2021-3518, DEBIAN-CVE-2021-3518, ECHO-cbc1-7e66-bf2c, GHSA-v4f8-2847-rwm7, JLSEC-2025-71, UBUNTU-CVE-2021-3518.