GHSA-q7wx-62r7-j2x7 CVE-2015-1819

Nokogiri vulnerable to libxml XML Entity Expansion

Medium RubyGems

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 6.29%; Chance of exploitation in the next 30 days. Higher than 93.59% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Fix: 1.6.6.4; Upgrade nokogiri to this version or later

Description

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

Affected versions

RubyGems

Package	Vulnerable	Fixed in
nokogiri	`>= 1.6.6.0, < 1.6.6.4`	`1.6.6.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

nokogiri RubyGems → `1.6.6.4`

bundler

bundle update nokogiri # Gemfile: gem "nokogiri", ">= 1.6.6.4"

Weakness

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

How to prevent it

Operation: If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
Implementation: Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2015-1819

Timeline

Aug 8, 2018 Published
Nov 29, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-phwj-rprq-35pp Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`	High	Also affects nokogiri
GHSA-wfpw-mmfh-qq69 Nokogiri: Possible Use-After-Free in XInclude Processing	Low	Also affects nokogiri
GHSA-p67v-3w7g-wjg7 Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime	Medium	Also affects nokogiri
GHSA-wjv4-x9w8-wm3h Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type	Medium	Also affects nokogiri
GHSA-5prr-v3j2-97mh Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`	High	Also affects nokogiri
GHSA-9cv2-cfxc-v4v2 Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes	High	Also affects nokogiri
GHSA-8678-w3jw-xfc2 Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247	Low	Also affects nokogiri
GHSA-5v8h-3h3q-446p Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception	High	Also affects nokogiri

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor