CVE-2022-50999
published 2026-08-25CVE-2022-50999: Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause…
PriorityP342high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | backend-rhel8 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp2 | toolbox-rhel9 | — | — |
| 3scale-amp2 | zync-rhel9 | — | — |
| nokogiri | nokogiri | < 1.13.5 | 1.13.5 |
| satellite_el8 | rubygem-nokogiri | — | — |
| sparklemotion | nokogiri | < 1.13.5 | 1.13.5 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes.
ghsa_unreviewed·2026-08-25
CVE-2022-50999 [HIGH] CWE-119 Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes.
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
Red Hat
nokogiri: libxml2: Nokogiri: Integer overflow in libxml2 leads to information disclosure, data modification, or denial of service
vendor_redhat·2026-08-25·CVSS 8.6
CVE-2022-50999 [HIGH] CWE-787 nokogiri: libxml2: Nokogiri: Integer overflow in libxml2 leads to information disclosure, data modification, or denial of service
nokogiri: libxml2: Nokogiri: Integer overflow in libxml2 leads to information disclosure, data modification, or denial of service
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
A flaw was found in Nokogiri. An integer overflow vulnerability in packaged libxml2 buffer handling functions allows a remote attacker to cause out-of-bounds memory writes. By crafting specially designed, large XML files, an attacker can trigger buffer overflows, leading to potential information disclosure, data modi
No detection rules found.
No public exploits indexed.
2026-08-25
Published