GHSA-xjqg-9jvg-fgx2 CVE-2015-5312

Nokogiri subject to DoS via libxml2 vulnerability

High RubyGems

Severity: High; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 4.50%; Chance of exploitation in the next 30 days. Higher than 91.50% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-400 Uncontrolled Resource Consumption
Fix: 1.6.7.1; Upgrade nokogiri to this version or later

Description

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 (as used in nokogiri before 1.6.7.1) does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.

Affected versions

RubyGems

Package	Vulnerable	Fixed in
nokogiri	`>= 1.6.0, < 1.6.7.1`	`1.6.7.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

nokogiri RubyGems → `1.6.7.1`

bundler

bundle update nokogiri # Gemfile: gem "nokogiri", ">= 1.6.7.1"

Weakness

CWE-400: Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

How to prevent it

Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
Implementation: Ensure that all failures in resource allocation place the system into a safe posture.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2015-5312

Timeline

Aug 21, 2018 Published
Nov 29, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-phwj-rprq-35pp Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`	High	Also affects nokogiri
GHSA-wfpw-mmfh-qq69 Nokogiri: Possible Use-After-Free in XInclude Processing	Low	Also affects nokogiri
GHSA-p67v-3w7g-wjg7 Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime	Medium	Also affects nokogiri
GHSA-wjv4-x9w8-wm3h Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type	Medium	Also affects nokogiri
GHSA-5prr-v3j2-97mh Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`	High	Also affects nokogiri
GHSA-9cv2-cfxc-v4v2 Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes	High	Also affects nokogiri
GHSA-8678-w3jw-xfc2 Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247	Low	Also affects nokogiri
GHSA-5v8h-3h3q-446p Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception	High	Also affects nokogiri

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor