CVE-2022-51000: Nokogiri libxml2/libxslt DoS Vulnerability

CVE-2022-51000 Overview

CVE-2022-51000 affects Nokogiri versions before 1.13.2 on CRuby when using packaged libraries. The affected releases ship vendored libxml2 2.9.12 and libxslt 1.1.34, both of which contain upstream vulnerabilities. Through CVE-2021-30560 in libxslt, applications transforming XML with untrusted XSL stylesheets are exposed to denial-of-service conditions. Through CVE-2022-23308 in libxml2, applications parsing untrusted documents with parse option DTDVALID set to true and NOENT set to false face potential denial of service, memory disclosure, or code execution. Nokogiri 1.13.2 resolves the issue by upgrading vendored dependencies to libxml2 2.9.13 and libxslt 1.1.35.

Critical Impact
Applications parsing untrusted XML with DTD validation enabled may face memory disclosure or arbitrary code execution through a use-after-free condition in the vendored libxml2 library.

Affected Products

Nokogiri (CRuby) versions before 1.13.2 when packaged with vendored libraries
Vendored libxml2 2.9.12 shipped inside Nokogiri
Vendored libxslt 1.1.34 shipped inside Nokogiri

Discovery Timeline

2026-08-25 - CVE-2022-51000 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2022-51000

Vulnerability Analysis

CVE-2022-51000 chains two upstream flaws inherited from libraries bundled with Nokogiri. The underlying weakness maps to [CWE-416: Use After Free], reflecting the higher-severity libxml2 component. The libxslt component (CVE-2021-30560) exposes applications performing XSLT transformations to a denial-of-service condition when processing attacker-controlled stylesheets.

The libxml2 component (CVE-2022-23308) is more consequential. Under the specific parse configuration where DTDVALID is enabled and NOENT is disabled, libxml2 mismanages ID attribute references during DTD validation. The resulting use-after-free permits memory disclosure and, under favorable heap layouts, arbitrary code execution.

Root Cause

The root cause is dependency inheritance. Nokogiri statically bundles libxml2 and libxslt at build time when installed from the CRuby packaged gem. Downstream Ruby applications running vulnerable Nokogiri versions therefore ship the flawed native code regardless of the host system's own patched libxml2 installation.

Attack Vector

Exploitation requires the target application to process untrusted XML input. For the libxslt path, the attacker supplies a malicious XSL stylesheet used in a transformation. For the libxml2 path, the attacker supplies an XML document containing crafted xml:id references while the application invokes parsing with DTDVALID=true and NOENT=false. No authentication is required when the application exposes XML processing over the network.

No verified public proof-of-concept code has been correlated to this Nokogiri advisory. Technical detail is documented in the GitHub Security Advisory GHSA-fq42-c5rg-92c2 and the VulnCheck Advisory on Nokogiri.

Detection Methods for CVE-2022-51000

Indicators of Compromise

Ruby applications with Gemfile.lock entries pinning nokogiri below 1.13.2
Native extensions in vendor/bundle linking to libxml2 2.9.12 or libxslt 1.1.34
Unexpected worker process crashes or segmentation faults during XML or XSLT processing
Anomalous memory content returned in application responses that render parsed XML data

Detection Strategies

Run software composition analysis (SCA) against Ruby project manifests to flag vulnerable Nokogiri versions.
Query runtime inventory for loaded shared objects and match against the vendored libxml2 2.9.12 and libxslt 1.1.34 fingerprints.
Inspect application logs for parser exceptions correlated with inbound XML payloads containing DTD declarations.

Monitoring Recommendations

Monitor Ruby application processes for abnormal termination signals and memory-region access violations.
Alert on outbound traffic anomalies following XML ingestion, which may indicate successful memory disclosure.
Track deployment pipelines to confirm updated Nokogiri versions land in production containers and artifacts.

How to Mitigate CVE-2022-51000

Immediate Actions Required

Upgrade Nokogiri to 1.13.2 or later on all CRuby deployments using the packaged gem.
Rebuild and redeploy container images and application artifacts that bundle Nokogiri.
Audit code paths that call Nokogiri::XML::Document.parse with DTD validation enabled and restrict them to trusted input.
Disable XSLT transformation of user-supplied stylesheets until the upgrade is complete.

Patch Information

Nokogiri 1.13.2 upgrades the vendored dependencies to libxml2 2.9.13 and libxslt 1.1.35, which contain the upstream fixes for CVE-2022-23308 and CVE-2021-30560. Patch commits are available at GitHub Commit 50f9c9c and GitHub Commit 652dd12.

Workarounds

Install Nokogiri with system libraries using --use-system-libraries when a patched system libxml2 is present.
Avoid enabling DTDVALID when parsing untrusted XML, and keep NOENT disabled for external content.
Reject XML documents containing DTD declarations at the application boundary when validation is not required.

bash

# Configuration example
bundle update nokogiri --conservative
bundle exec ruby -rnokogiri -e 'puts Nokogiri::VERSION_INFO'
# Verify output shows nokogiri >= 1.13.2 with libxml2 >= 2.9.13 and libxslt >= 1.1.35