CVE-2022-50999: Nokogiri libxml2 Buffer Overflow Vulnerability

CVE-2022-50999 Overview

CVE-2022-50999 is an integer overflow vulnerability in Nokogiri versions before 1.13.5. The flaw resides in the buffer handling functions of the bundled libxml2 library. Attackers can trigger out-of-bounds memory writes by supplying crafted multi-gigabyte XML files to applications that parse untrusted XML with Nokogiri. Successful exploitation can lead to information disclosure, data modification, or denial of service. The vulnerability is tracked under [CWE-119] (improper restriction of operations within the bounds of a memory buffer) and affects any Ruby application relying on vulnerable Nokogiri releases for XML or HTML parsing.

Critical Impact
A network-reachable attacker can send crafted multi-gigabyte XML input to trigger a buffer overflow in libxml2, causing memory corruption, service disruption, or exposure of process memory.

Affected Products

Nokogiri versions prior to 1.13.5
Bundled libxml2 buffer handling routines shipped with Nokogiri
Ruby applications that parse untrusted XML or HTML using affected Nokogiri releases

Discovery Timeline

2026-08-25 - CVE-2022-50999 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2022-50999

Vulnerability Analysis

The vulnerability is an integer overflow in the buffer handling functions of libxml2 bundled with Nokogiri. When the parser calculates buffer sizes for very large XML inputs, arithmetic on a size or length value wraps around the integer type's maximum value. The resulting undersized allocation is then used as the destination for a larger write, producing an out-of-bounds memory write on the heap.

Because Nokogiri statically vendors libxml2, the flaw affects Nokogiri installations even on systems where the operating system's libxml2 package has already been patched. Applications that expose XML or HTML parsing to remote input, such as SOAP services, RSS/Atom aggregators, SAML consumers, and document ingestion pipelines, are directly exposed.

Depending on heap layout and adjacent structures, the write can corrupt parser state, disclose adjacent memory, or crash the Ruby process. The condition requires the attacker to deliver input on the order of gigabytes, which constrains but does not eliminate practical exploitation over networks that accept large payloads.

Root Cause

The root cause is unchecked arithmetic in the buffer growth path of libxml2. Size computations used to grow input or output buffers overflow the underlying integer type before the allocation is made. The subsequent copy operation uses a length derived from the original, non-overflowed value and writes past the smaller allocation. The upstream fix, mirrored in Nokogiri commit 2554a24, adds range checks and safer size handling to the buffer routines.

Attack Vector

Exploitation is remote and requires no authentication or user interaction, but requires that the target application accept and parse very large attacker-supplied XML documents. A typical attack path involves POSTing a multi-gigabyte XML payload to a service endpoint that invokes Nokogiri::XML::Document.parse or a similar API on the request body. See the GitHub Security Advisory GHSA-cgx6-hpwq-fhv5 and the VulnCheck advisory for additional technical detail. No verified public exploit code is available at this time.

Detection Methods for CVE-2022-50999

Indicators of Compromise

Ruby or nokogiri-linked worker processes crashing with segmentation faults or SIGABRT during XML parsing.
Application logs showing libxml2 parser errors immediately preceding process termination.
HTTP request logs with request bodies in the multi-gigabyte range directed at XML or HTML parsing endpoints.
Unexpected spikes in memory allocation by Ruby processes handling inbound XML.

Detection Strategies

Inventory installed Nokogiri versions with bundle list nokogiri or gem list nokogiri across all Ruby services and flag any version below 1.13.5.
Correlate web server access logs with application crash events to identify oversized XML requests preceding worker restarts.
Use software composition analysis (SCA) tooling to flag transitive dependencies on vulnerable Nokogiri releases in Gemfile.lock.

Monitoring Recommendations

Alert on HTTP request bodies exceeding a defined size threshold to endpoints that parse XML.
Monitor Ruby process resident set size (RSS) and out-of-memory (OOM) kill events on application hosts.
Track dependency drift so that Nokogiri upgrades are enforced in CI pipelines and container image builds.

How to Mitigate CVE-2022-50999

Immediate Actions Required

Upgrade Nokogiri to version 1.13.5 or later in all Ruby applications and rebuild affected container images.
Enforce a maximum request body size at the reverse proxy or load balancer to block multi-gigabyte XML payloads.
Audit ingestion pipelines that accept XML from untrusted sources and disable them until patched.
Rebuild any custom gems that vendor Nokogiri as a native dependency to ensure the fixed libxml2 is compiled in.

Patch Information

The issue is fixed in Nokogiri 1.13.5. Upstream applied the fix in commit 2554a24, which corrects the buffer size handling in the bundled libxml2. Update Gemfile constraints to require nokogiri >= 1.13.5 and run bundle update nokogiri followed by full application redeployment.

Workarounds

Configure Nginx, HAProxy, or your API gateway with a strict client_max_body_size (or equivalent) below the multi-gigabyte range required to trigger the overflow.
Reject or truncate XML payloads at the application layer before they reach the parser when the upgrade cannot be applied immediately.
Isolate XML parsing workloads in dedicated processes with memory limits so that a crash does not affect unrelated services.

bash

# Configuration example
# 1. Pin the fixed Nokogiri release in Gemfile
#    gem "nokogiri", ">= 1.13.5"
bundle update nokogiri
bundle list nokogiri

# 2. Cap request body size in Nginx to block oversized XML payloads
# /etc/nginx/nginx.conf
# http {
#   client_max_body_size 10m;
# }
sudo nginx -t && sudo systemctl reload nginx