CVE-2021-47996: Nokogiri libxml2 DoS Vulnerability

CVE-2021-47996 Overview

CVE-2021-47996 affects Nokogiri versions before 1.11.4 when the CRuby implementation uses the packaged or vendored libxml2 library. The vulnerable release bundles libxml2 2.9.10, which contains four upstream flaws addressed in libxml2 2.9.12. These include a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents can lead to denial of service, information disclosure, or memory corruption.

Critical Impact
Applications parsing untrusted XML with vulnerable Nokogiri versions may crash, leak memory contents, or experience heap corruption.

Affected Products

Nokogiri versions prior to 1.11.4 (CRuby implementation)
Deployments using the packaged or vendored libxml2 2.9.10
Ruby applications parsing untrusted XML or XML Schema input

Discovery Timeline

2026-08-25 - CVE-2021-47996 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2021-47996

Vulnerability Analysis

CVE-2021-47996 is a supply-chain style disclosure. Nokogiri, a widely used Ruby XML/HTML parser, statically bundles libxml2 for CRuby builds. Versions before 1.11.4 ship libxml2 2.9.10, inheriting four distinct memory-safety issues classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer).

Each bundled flaw impacts a different XML processing path. CVE-2019-20388 leaks memory during streaming schema validation. CVE-2020-24977 reads past the bounds of a global buffer while encoding XML entities. CVE-2021-3517 overflows a heap allocation during UTF-8 processing of malformed XML. CVE-2021-3518 triggers a use-after-free style out-of-bounds read in the XML reader.

The network-reachable nature of XML parsers—used in RSS ingestion, SAML flows, SOAP endpoints, document import features, and web scrapers—means attacker-controlled XML frequently reaches the vulnerable code paths without authentication.

Root Cause

The root cause is the vendored libxml2 2.9.10 shipped inside Nokogiri gem binaries. Applications that rely on the packaged libxml2 cannot benefit from operating-system patches to the system libxml2, so the vulnerable code remains active even on a fully patched host.

Attack Vector

An attacker supplies a crafted XML document, XML Schema, or entity-encoded payload to any application endpoint that parses input with Nokogiri. Depending on which underlying flaw is triggered, the outcome ranges from denial of service and memory exhaustion to disclosure of adjacent heap memory or heap corruption. No authentication or user interaction is required when parsers are exposed on network-facing services.

See the Nokogiri GitHub Security Advisory GHSA-7rrm-v45f-jp64 and the VulnCheck Nokogiri Vulnerabilities Advisory for the underlying advisory content.

Detection Methods for CVE-2021-47996

Indicators of Compromise

Ruby application crashes or SIGSEGV events originating in libxml2 or Nokogiri native extensions
Unexpected memory growth in long-running Ruby workers that process XML input
Anomalous XML payloads containing malformed entity references, oversized UTF-8 sequences, or deeply nested schema imports

Detection Strategies

Inventory installed gem versions with bundle list nokogiri or gem list nokogiri across all Ruby hosts and CI images
Query software bill of materials (SBOM) data for Nokogiri versions below 1.11.4 and for bundled libxml2 2.9.10
Add web application firewall or reverse-proxy rules that log oversized or malformed XML payloads sent to endpoints known to invoke Nokogiri

Monitoring Recommendations

Alert on repeated segmentation faults or abnormal exits in Ruby processes handling XML
Track outbound requests and error rates from XML-processing services for signs of denial-of-service abuse
Continuously monitor dependency manifests (Gemfile.lock) in source repositories for regressions to vulnerable Nokogiri releases

How to Mitigate CVE-2021-47996

Immediate Actions Required

Upgrade Nokogiri to 1.11.4 or later on all CRuby deployments, then redeploy applications
Rebuild container images, serverless bundles, and CI artifacts so cached layers do not retain the vulnerable gem
Audit third-party gems that depend on Nokogiri and update transitive constraints where necessary

Patch Information

The fix is delivered in Nokogiri 1.11.4, which bundles libxml2 2.9.12 with the upstream corrections for CVE-2019-20388, CVE-2020-24977, CVE-2021-3517, and CVE-2021-3518. Relevant upstream commits are referenced in the Nokogiri advisory, including commit 0e1a49c, commit 1098c30, and commit bf22713.

Workarounds

Install Nokogiri with the --use-system-libraries build flag so it links against a patched system libxml2 (2.9.12 or later)
Reject or size-limit untrusted XML at the network edge until the gem upgrade is deployed
Disable XML Schema validation and DTD processing on code paths that accept external input where feasible

bash

# Rebuild Nokogiri against a patched system libxml2
gem uninstall nokogiri
bundle config build.nokogiri --use-system-libraries
bundle install

# Or upgrade to a fixed release
bundle update nokogiri --conservative # ensure >= 1.11.4