CVE-2022-23476 Unchecked return value from xmlTextReaderExpand in Nokogiri
Attackers can cause a denial of service via null pointer exception in Nokogiri when parsing invalid markup with XML::Reader.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23476?
CVE-2022-23476 is a high-severity vulnerability in sparklemotion nokogiri, published on 8 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.
Which versions are affected by CVE-2022-23476?
2 open source packages ship an affected version, including nokogiri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | From 1.13.8 | 1.13.10 |
nokogiri RubyGems | From 1.13.8 | 1.13.10 |
Products include Nokogiri Nokogiri.
How do I fix CVE-2022-23476?
Upgrade nokogiri to 1.13.10 or later.
Is CVE-2022-23476 being exploited?
There is no known exploitation of CVE-2022-23476 in the wild and no public exploit code.
Other vulnerabilities in sparklemotion nokogiri
- CVE-2026-79770 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
- CVE-2021-41098 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
- CVE-2012-6685 Nokogiri is vulnerable to XML External Entity (XXE) attack
- CVE-2026-79771 Nokogiri before 1.19.3 Memory Leak via XSLT Transform
- CVE-2026-79772 Nokogiri before 1.19.1 Unchecked Return Value canonicalize
Sources
Also known as DEBIAN-CVE-2022-23476, GHSA-qv4q-mr5r-qprj.