CVE-2023-54354 Overview
CVE-2023-54354 affects Nokogiri, a widely used XML and HTML parsing library for Ruby. Versions before 1.14.3 (CRuby implementation with the packaged libxml2) bundle libxml2 v2.10.3, which contains NULL pointer dereferences in XML Schema processing. A crafted or malformed XML schema triggers NULL pointer dereferences in xmlSchemaFixupComplexType (CVE-2023-28484) and xmlSchemaCheckCOSSTDerivedOK. Successful exploitation causes libxml2 to segfault, producing a denial-of-service condition in any application that parses attacker-supplied schemas. Nokogiri 1.14.3 resolves the issue by upgrading the packaged libxml2 to v2.10.4.
Critical Impact
Remote, unauthenticated attackers can crash Ruby applications that parse untrusted XML schemas with Nokogiri, causing denial of service.
Affected Products
- Nokogiri versions prior to 1.14.3 (CRuby implementation)
- Nokogiri builds using the packaged libxml2 v2.10.3
- Ruby applications that parse untrusted XML schemas via Nokogiri
Discovery Timeline
- 2026-08-25 - CVE-2023-54354 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2023-54354
Vulnerability Analysis
The flaw is a NULL pointer dereference [CWE-476] within libxml2's XML Schema processing code. Nokogiri statically bundles libxml2 when installed from source or via prebuilt gems, so the vulnerable native library ships inside the Ruby dependency. When Nokogiri parses a crafted schema, control flows into xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK, where pointer fields expected to reference schema components are never validated before dereference. Any application exposing XML schema parsing to network input, such as SOAP endpoints, XSD validators, or document ingestion pipelines, inherits the crash condition. The attack does not yield code execution or data disclosure but reliably terminates the worker process handling the request.
Root Cause
libxml2 v2.10.3 fails to validate internal schema component pointers before dereferencing them during complex type fixup and derivation checks. Malformed schema constructs leave these pointers as NULL, producing a segmentation fault when the fields are accessed. The upstream libxml2 project addressed the issue in v2.10.4, and Nokogiri 1.14.3 pulled in that release.
Attack Vector
An unauthenticated remote attacker submits a malformed XML schema to any endpoint that invokes Nokogiri schema parsing or validation. The vulnerability requires no privileges and no user interaction. The parser dereferences a NULL pointer inside the native libxml2 code, and the host process terminates. Repeated requests amplify the impact into a sustained denial of service against multi-worker application servers.
No verified proof-of-concept code is publicly indexed for this specific advisory. Technical details are available in the GitHub Security Advisory GHSA-pxvg-2qj5-37jq and the VulnCheck Advisory on Nokogiri.
Detection Methods for CVE-2023-54354
Indicators of Compromise
- Unexpected SIGSEGV termination of Ruby worker processes handling XML input
- Application server logs showing repeated crashes tied to Nokogiri schema parsing calls
- Core dumps referencing xmlSchemaFixupComplexType or xmlSchemaCheckCOSSTDerivedOK
- Inbound HTTP requests containing malformed XSD payloads targeting SOAP or XML validation endpoints
Detection Strategies
- Inventory Ruby applications and identify Nokogiri versions with bundle list nokogiri or gem list nokogiri and flag versions below 1.14.3.
- Enable software composition analysis (SCA) rules that alert on vulnerable Nokogiri and libxml2 releases in dependency manifests.
- Correlate web application firewall logs for XSD or schema payloads with backend process restart events.
Monitoring Recommendations
- Monitor process supervisors such as systemd, Puma, or Unicorn for abnormal restart frequency on XML-handling services.
- Alert on segmentation faults recorded in kernel logs for Ruby interpreter processes.
- Track dependency drift in CI pipelines to prevent reintroduction of vulnerable Nokogiri versions.
How to Mitigate CVE-2023-54354
Immediate Actions Required
- Upgrade Nokogiri to 1.14.3 or later on all Ruby applications and container images.
- Rebuild and redeploy any application that vendors Nokogiri natively so the bundled libxml2 v2.10.4 is loaded.
- Audit application entry points that accept XML schemas from untrusted sources and gate them behind authentication where feasible.
Patch Information
Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4, which contains the upstream fixes for xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK. Refer to the upstream commits 09a2dd4, 4c6922e, and 647e072 for the specific changes.
Workarounds
- Configure Nokogiri to link against a system-provided libxml2 at or above v2.10.4 if immediate gem upgrade is not possible.
- Reject inbound XML schema documents at the reverse proxy or WAF until the patch is deployed.
- Isolate XML parsing workers in sandboxed processes so a crash does not affect the primary application.
# Update Nokogiri to a fixed release
bundle update nokogiri --conservative
bundle list nokogiri # confirm version >= 1.14.3
# Verify the bundled libxml2 version at runtime
ruby -rnokogiri -e 'puts Nokogiri::VERSION_INFO["libxml"]["loaded"]'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
