CVE-2021-47996
- Source
- https://cve.org/CVERecord?id=CVE-2021-47996
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47996.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-47996
- Aliases
- Downstream
- Published
- 2026-08-25T16:16:42Z
- Modified
- 2026-09-03T08:11:20Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption.
- References
-
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64
- https://www.vulncheck.com/advisories/nokogiri-before-multiple-vulnerabilities-via-libxml2
- https://github.com/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5
- https://github.com/GNOME/libxml2/commit/1098c30a040e72a4654968547f415be4e4c40fe7
- https://github.com/GNOME/libxml2/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
- https://github.com/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
- https://github.com/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a
- https://github.com/GNOME/libxml2/commit/8598060bacada41a0eb09d95c97744ff4e428f8e
- https://github.com/GNOME/libxml2/commit/babe75030c7f64a37826bb3342317134568bef61
- https://github.com/GNOME/libxml2/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2
Affected packages
Git / github.com/gnome/libxml2
Affected versions
Other
CVE-2013-2877
CVE-2014-0191
CVE-2014-3660
CVE-2015-1819
CVE-2015-5312
CVE-2015-7497
CVE-2015-7498
CVE-2015-7499-1
CVE-2015-7499-2
CVE-2015-7500
CVE-2015-7941_1
CVE-2015-7941_2
CVE-2015-7942
CVE-2015-7942-2
CVE-2015-8035
CVE-2015-8242
CVE-2015-8317
CVE-2016-1762
CVE-2016-1833
CVE-2016-1834
CVE-2016-1835
CVE-2016-1836
CVE-2016-1837
CVE-2016-1838
CVE-2016-1839
CVE-2016-1840
CVE-2016-3627
CVE-2016-3705
CVE-2016-4449
CVE-2016-4483
EAZEL-NAUTILUS-MS-AUG07
FOR_GNOME_0_99_1
GNOME_0_30
GNOME_PRINT_0_24
GNUMERIC_FIRST_PUBLIC_RELEASE
LIBXML2_2_4_21
LIBXML2_2_5_0
LIBXML2_2_5_10
LIBXML2_2_5_7
LIBXML2_2_5_8
LIBXML2_2_5_9
LIBXML2_2_5_x
LIBXML2_2_6_1
LIBXML2_2_6_11
LIBXML2_2_6_12
LIBXML2_2_6_13
LIBXML2_2_6_14
LIBXML2_2_6_15
LIBXML2_2_6_16
LIBXML2_2_6_18
LIBXML2_2_6_19
LIBXML2_2_6_2
LIBXML2_2_6_20
LIBXML2_2_6_21
LIBXML2_2_6_22
LIBXML2_2_6_23
LIBXML2_2_6_24
LIBXML2_2_6_26
LIBXML2_2_6_27
LIBXML2_2_6_28
LIBXML2_2_6_3
LIBXML2_2_6_4
LIBXML2_2_6_5
LIBXML2_2_6_6
LIBXML2_2_6_7
LIBXML2_2_6_8
LIBXML2_2_6_9
LIBXML2_6_0
LIBXML_0_99
LIBXML_1_5_0
LIBXML_1_8_5
LIBXML_1_8_6
LIBXML_2_0_0
LIBXML_2_1_0
LIBXML_2_1_1
LIBXML_2_2_1
LIBXML_2_2_3
LIBXML_2_2_4
LIBXML_2_2_6
LIBXML_2_2_7
LIBXML_2_2_8
LIBXML_2_3_0
LIBXML_2_3_10
LIBXML_2_3_11
LIBXML_2_3_12
LIBXML_2_3_13
LIBXML_2_3_14
LIBXML_2_3_2
LIBXML_2_3_3
LIBXML_2_3_4
LIBXML_2_3_5
LIBXML_2_3_6
LIBXML_2_3_7
LIBXML_2_3_8
LIBXML_2_3_9
LIBXML_2_4_0
LIBXML_2_4_11
LIBXML_2_4_12
LIBXML_2_4_13
LIBXML_2_4_14
LIBXML_2_4_16
LIBXML_2_4_18
LIBXML_2_4_2
LIBXML_2_4_20
LIBXML_2_4_22
LIBXML_2_4_23
LIBXML_2_4_24
LIBXML_2_4_25
LIBXML_2_4_26
LIBXML_2_4_27
LIBXML_2_4_29
LIBXML_2_4_3
LIBXML_2_4_30
LIBXML_2_4_4
LIBXML_2_4_6
LIBXML_2_4_7
LIBXML_2_5_1
LIBXML_2_5_2
LIBXML_2_5_3
LIBXML_2_5_4
LIBXML_2_5_5
LIBXML_2_5_6
LIBXML_2_6_10
LIBXML_TEST_2_0_0
LIB_XML_1_1
LIB_XML_1_3
LIB_XML_1_4
LIB_XML_1_6_1
LIB_XML_1_6_2
LIB_XML_1_7_0
LIB_XML_1_7_1
LIB_XML_1_7_3
LIB_XML_1_8_3
LIB_XML_1_X
PRE_MUCKUP
PRE_MUCKUP2
PRE_MUCKUP3
help
LIBXML2.*
LIBXML2.6.32
LIBXML2.7.0
LIBXML2.7.1
LIBXML2.7.2
LIBXML2.7.3
v2.*
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.8.0
v2.8.0-rc1
v2.8.0-rc2
v2.9.0
v2.9.0-rc2
v2.9.1
v2.9.10
v2.9.10-rc1
v2.9.2
v2.9.2-rc1
v2.9.2-rc2
v2.9.3
v2.9.4
v2.9.4-rc1
v2.9.4-rc2
v2.9.5
v2.9.5-rc1
v2.9.5-rc2
v2.9.6
v2.9.6-rc1
v2.9.7
v2.9.7-rc1
v2.9.8
v2.9.8-rc1
v2.9.9
v2.9.9-rc1
v2.9.9-rc2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47996.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"125923364555687102912767750593616075062",
"164402031157988608807981467698484062586",
"187480151731575691958788539215601771876",
"198926099027557728522349673134118447470"
],
"threshold": 0.9
},
"id": "CVE-2021-47996-0cb4c5da",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/1358d157d0bd83be1dfe356a69213df9fac0b539",
"target": {
"file": "xmllint.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"247568056470202954226467748573418683172",
"94265484478106808140284082942404196729",
"54827508396231888230909548411994015125",
"279820038266218910920837730438313773675"
],
"threshold": 0.9
},
"id": "CVE-2021-47996-2681a3f2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5",
"target": {
"file": "parser.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "133584636054340721205278925695833658201",
"length": 3540
},
"id": "CVE-2021-47996-3d708e2c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2",
"target": {
"file": "entities.c",
"function": "xmlEncodeEntitiesInternal"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "129795723050783868420429153906754155297",
"length": 1498
},
"id": "CVE-2021-47996-4e1d4e57",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/1098c30a040e72a4654968547f415be4e4c40fe7",
"target": {
"file": "xinclude.c",
"function": "xmlXIncludeDoProcess"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"238830279518026173601265985036679831221",
"6818339520559522538802628149446565204",
"21168215039705633172313227177812164754",
"44368582528979308298264734089416623463"
],
"threshold": 0.9
},
"id": "CVE-2021-47996-6c0b3bb4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a",
"target": {
"file": "xmlschemas.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "72281996671305061154380570581536082488",
"length": 878
},
"id": "CVE-2021-47996-70f543c3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a",
"target": {
"file": "xmlschemas.c",
"function": "xmlSchemaPreRun"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "318309956330829112293536792403977466123",
"length": 4010
},
"id": "CVE-2021-47996-8b9baf91",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5",
"target": {
"file": "parser.c",
"function": "xmlStringLenDecodeEntities"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"139217053892453545114406503002699038551",
"74174908839482910117114283962298867577",
"12712912407859303312203914586923544226",
"177575747721188392079589196392735439354",
"221866373724369158298727459108826691197",
"154882006815943080874703791132029998543"
],
"threshold": 0.9
},
"id": "CVE-2021-47996-a0bae2e0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2",
"target": {
"file": "entities.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"168672058864961257859405146754354472187",
"64644107898846976266284128143066975089",
"182440086416972751708829220127142151095"
],
"threshold": 0.9
},
"id": "CVE-2021-47996-abd1bcbd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2",
"target": {
"file": "xmllint.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"251243055166309716996962376314600332998",
"247021566701966566980313579297150334381",
"226559000756074575733463851249290972653",
"147375703684160506692803477328459167434",
"235123860312544971819592858258290679121",
"292652530897578466916550773007602664398"
],
"threshold": 0.9
},
"id": "CVE-2021-47996-c8855bc2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/1098c30a040e72a4654968547f415be4e4c40fe7",
"target": {
"file": "xinclude.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "333089290179452094192545213626485405871",
"length": 227
},
"id": "CVE-2021-47996-d5396ad3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gnome/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2",
"target": {
"file": "xmllint.c",
"function": "xmlHTMLEncodeSend"
}
}
]
vanir_signatures_modified
"2026-09-03T08:11:20Z"
Git / github.com/sparklemotion/nokogiri
Affected ranges
- Type
- GIT
- Repo
- https://github.com/sparklemotion/nokogiri
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "1.11.4" } ], "source": "CPE_RANGE" }
Affected versions
1.*
1.7.0.1-linux-binary1
REL_1.*
REL_1.0.0
REL_1.0.1
REL_1.0.2
REL_1.0.3
REL_1.0.4
REL_1.0.5
REL_1.0.6
REL_1.0.7
REL_1.5.0.beta.1
REL_1.5.0.beta.2
v1.*
v1.10.0
v1.10.0.rc1
v1.10.1
v1.10.2
v1.10.3
v1.11.0
v1.11.0.rc1
v1.11.0.rc2
v1.11.0.rc3
v1.11.0.rc4
v1.11.1
v1.11.2
v1.11.3
v1.5.0
v1.5.0.beta.3
v1.5.0.beta.4
v1.5.1
v1.5.1.rc1
v1.5.2
v1.5.3
v1.5.3.rc1
v1.5.3.rc3
v1.5.3.rc4
v1.5.3.rc5
v1.5.3.rc6
v1.5.4.rc1
v1.5.4.rc2
v1.5.4.rc3
v1.5.5.rc1
v1.5.5.rc2
v1.5.6
v1.5.6.rc2
v1.5.7
v1.5.7.rc1
v1.5.7.rc2
v1.5.7.rc3
v1.5.8
v1.5.9
v1.6.0
v1.6.0.rc1
v1.6.2
v1.6.2.1
v1.6.2.beta.1
v1.6.2.rc1
v1.6.2.rc3
v1.6.3
v1.6.3.1
v1.6.3.rc1
v1.6.3.rc2
v1.6.3.rc3
v1.6.4
v1.6.5
v1.6.6
v1.6.6.1
v1.6.6.2
v1.6.7.rc1
v1.6.7.rc2
v1.6.7.rc3
v1.6.7.rc4
v1.6.8
v1.6.8.rc1
v1.6.8.rc2
v1.6.8.rc3
v1.7.0
v1.7.0.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.9.0
v1.9.0.rc1
v1.9.1