Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption.

Nokogiri versions before 1.11.4 (CRuby implementation using packaged/vendored libxml2) bundle libxml2 2.9.10, which contains multiple known vulnerabilities fixed in libxml2 2.9.12. The bundled vulnerable library exposes users to CVE-2019-20388 (memory leak in xmlSchemaValidateStream), CVE-2020-24977 (global buffer over-read in xmlEncodeEntitiesInternal), CVE-2021-3517 (heap-based buffer overflow), and CVE-2021-3518 (out-of-bounds read). Exploitation occurs through processing of specially crafted XML documents. Potential impacts include denial of service, information disclosure, and memory corruption. The vulnerability is a supply chain/dependency issue stemming from vendored third-party library usage. Fixes are available via multiple commits to the Nokogiri repository and upgrading to version 1.11.4 or later is recommended.