Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 (data corruption / double-free from an entity reference cycle when entity content is allocated from a dict) and CVE-2022-40303 (integer overflows when parsing with XML_PARSE_HUGE). Nokogiri 1.13.9 upgrades the packaged libxml2 to v2.10.3 to address these issues. Processing crafted XML input may lead to denial of service or memory corruption. (The advisory also references CVE-2022-2309, a NULL pointer dereference via iterwalk/canonicalize, which maintainers determined does not affect Nokogiri users.)

Nokogiri versions before 1.13.9 (CRuby implementation with packaged libraries) bundle libxml2 v2.9.14, which is vulnerable to two critical issues. CVE-2022-40304 involves data corruption and a double-free vulnerability triggered by entity reference cycles when entity content is allocated from a dict. CVE-2022-40303 involves integer overflows when parsing XML with the XML_PARSE_HUGE flag. Nokogiri 1.13.9 addresses these by upgrading the bundled libxml2 to v2.10.3. Processing crafted XML input in affected versions may lead to denial of service or memory corruption. A third CVE (CVE-2022-2309, a NULL pointer dereference) was referenced in the advisory but determined by maintainers to not affect Nokogiri users. The vulnerability affects applications relying on Nokogiri for XML parsing in Ruby environments. Patches are available via commits in the Nokogiri GitHub repository.