CVE-2023-54354

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-54354
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54354.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-54354
Aliases
Published
2026-08-25T15:15:55.858Z
Modified
2026-08-30T08:13:43.084606Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Nokogiri before 1.14.3 Null Pointer Dereference via libxml2
Details

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54354.json",
    "cwe_ids": [
        "CWE-476"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/gnome/libxml2

Affected ranges

Type
GIT
Repo
https://github.com/gnome/libxml2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
09a2dd453007f9c7205274623acdd73747c22d64
Fixed
4c6922f763ad958c48ff66f82823ae21f2e92ee6
Fixed
647e072ea0a2f12687fa05c172f4c4713fdb0c4f
Database specific
Show details 
{
    "source": "REFERENCES"
}
Type
GIT
Repo
https://github.com/sparklemotion/nokogiri
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8d2f4a829c50e6ad4ccd1625cd094e3a24acf36
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.14.3"
        }
    ]
}

Affected versions

1.*
1.7.0.1-linux-binary1
Other
CVE-2013-2877
CVE-2014-0191
CVE-2014-3660
CVE-2015-1819
CVE-2015-5312
CVE-2015-7497
CVE-2015-7498
CVE-2015-7499-1
CVE-2015-7499-2
CVE-2015-7500
CVE-2015-7941_1
CVE-2015-7941_2
CVE-2015-7942
CVE-2015-7942-2
CVE-2015-8035
CVE-2015-8242
CVE-2015-8317
CVE-2016-1762
CVE-2016-1833
CVE-2016-1834
CVE-2016-1835
CVE-2016-1836
CVE-2016-1837
CVE-2016-1838
CVE-2016-1839
CVE-2016-1840
CVE-2016-3627
CVE-2016-3705
CVE-2016-4449
CVE-2016-4483
CVE-2021-3541
EAZEL-NAUTILUS-MS-AUG07
FOR_GNOME_0_99_1
GNOME_0_30
GNOME_PRINT_0_24
GNUMERIC_FIRST_PUBLIC_RELEASE
LIBXML2_2_4_21
LIBXML2_2_5_0
LIBXML2_2_5_10
LIBXML2_2_5_7
LIBXML2_2_5_8
LIBXML2_2_5_9
LIBXML2_2_5_x
LIBXML2_2_6_1
LIBXML2_2_6_11
LIBXML2_2_6_12
LIBXML2_2_6_13
LIBXML2_2_6_14
LIBXML2_2_6_15
LIBXML2_2_6_16
LIBXML2_2_6_18
LIBXML2_2_6_19
LIBXML2_2_6_2
LIBXML2_2_6_20
LIBXML2_2_6_21
LIBXML2_2_6_22
LIBXML2_2_6_23
LIBXML2_2_6_24
LIBXML2_2_6_26
LIBXML2_2_6_27
LIBXML2_2_6_28
LIBXML2_2_6_3
LIBXML2_2_6_4
LIBXML2_2_6_5
LIBXML2_2_6_6
LIBXML2_2_6_7
LIBXML2_2_6_8
LIBXML2_2_6_9
LIBXML2_6_0
LIBXML_0_99
LIBXML_1_5_0
LIBXML_1_8_5
LIBXML_1_8_6
LIBXML_2_0_0
LIBXML_2_1_0
LIBXML_2_1_1
LIBXML_2_2_1
LIBXML_2_2_3
LIBXML_2_2_4
LIBXML_2_2_6
LIBXML_2_2_7
LIBXML_2_2_8
LIBXML_2_3_0
LIBXML_2_3_10
LIBXML_2_3_11
LIBXML_2_3_12
LIBXML_2_3_13
LIBXML_2_3_14
LIBXML_2_3_2
LIBXML_2_3_3
LIBXML_2_3_4
LIBXML_2_3_5
LIBXML_2_3_6
LIBXML_2_3_7
LIBXML_2_3_8
LIBXML_2_3_9
LIBXML_2_4_0
LIBXML_2_4_11
LIBXML_2_4_12
LIBXML_2_4_13
LIBXML_2_4_14
LIBXML_2_4_16
LIBXML_2_4_18
LIBXML_2_4_2
LIBXML_2_4_20
LIBXML_2_4_22
LIBXML_2_4_23
LIBXML_2_4_24
LIBXML_2_4_25
LIBXML_2_4_26
LIBXML_2_4_27
LIBXML_2_4_29
LIBXML_2_4_3
LIBXML_2_4_30
LIBXML_2_4_4
LIBXML_2_4_6
LIBXML_2_4_7
LIBXML_2_5_1
LIBXML_2_5_2
LIBXML_2_5_3
LIBXML_2_5_4
LIBXML_2_5_5
LIBXML_2_5_6
LIBXML_2_6_10
LIBXML_TEST_2_0_0
LIB_XML_1_1
LIB_XML_1_3
LIB_XML_1_4
LIB_XML_1_6_1
LIB_XML_1_6_2
LIB_XML_1_7_0
LIB_XML_1_7_1
LIB_XML_1_7_3
LIB_XML_1_8_3
LIB_XML_1_X
PRE_MUCKUP
PRE_MUCKUP2
PRE_MUCKUP3
help
LIBXML2.*
LIBXML2.6.32
LIBXML2.7.0
LIBXML2.7.1
LIBXML2.7.2
LIBXML2.7.3
REL_1.*
REL_1.0.0
REL_1.0.1
REL_1.0.2
REL_1.0.3
REL_1.0.4
REL_1.0.5
REL_1.0.6
REL_1.0.7
REL_1.5.0.beta.1
REL_1.5.0.beta.2
v1.*
v1.10.0
v1.10.0.rc1
v1.10.1
v1.10.2
v1.10.3
v1.11.0
v1.11.0.rc1
v1.11.0.rc2
v1.11.0.rc3
v1.11.0.rc4
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.0.rc1
v1.12.1
v1.12.2
v1.12.3
v1.13.0
v1.14.0
v1.14.0.rc1
v1.14.1
v1.14.2
v1.5.0
v1.5.0.beta.3
v1.5.0.beta.4
v1.5.1
v1.5.1.rc1
v1.5.2
v1.5.3
v1.5.3.rc1
v1.5.3.rc3
v1.5.3.rc4
v1.5.3.rc5
v1.5.3.rc6
v1.5.4.rc1
v1.5.4.rc2
v1.5.4.rc3
v1.5.5.rc1
v1.5.5.rc2
v1.5.6
v1.5.6.rc2
v1.5.7
v1.5.7.rc1
v1.5.7.rc2
v1.5.7.rc3
v1.5.8
v1.5.9
v1.6.0
v1.6.0.rc1
v1.6.2
v1.6.2.1
v1.6.2.beta.1
v1.6.2.rc1
v1.6.2.rc3
v1.6.3
v1.6.3.1
v1.6.3.rc1
v1.6.3.rc2
v1.6.3.rc3
v1.6.4
v1.6.5
v1.6.6
v1.6.6.1
v1.6.6.2
v1.6.7.rc1
v1.6.7.rc2
v1.6.7.rc3
v1.6.7.rc4
v1.6.8
v1.6.8.rc1
v1.6.8.rc2
v1.6.8.rc3
v1.7.0
v1.7.0.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.9.0
v1.9.0.rc1
v1.9.1
v2.*
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.8.0
v2.8.0-rc1
v2.8.0-rc2
v2.9.0
v2.9.0-rc2
v2.9.1
v2.9.10
v2.9.10-rc1
v2.9.11
v2.9.12
v2.9.13
v2.9.2
v2.9.2-rc1
v2.9.2-rc2
v2.9.3
v2.9.4
v2.9.4-rc1
v2.9.4-rc2
v2.9.5
v2.9.5-rc1
v2.9.5-rc2
v2.9.6
v2.9.6-rc1
v2.9.7
v2.9.7-rc1
v2.9.8
v2.9.8-rc1
v2.9.9
v2.9.9-rc1
v2.9.9-rc2

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2023-54354-49d37df2",
        "target": {
            "function": "xmlSchemaResolveElementReferences",
            "file": "xmlschemas.c"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "161823131667449630370724922190556095829",
            "length": 1316.0
        },
        "signature_version": "v1",
        "source": "https://github.com/gnome/libxml2/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-54354-93aea704",
        "target": {
            "function": "xmlDictComputeFastKey",
            "file": "dict.c"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "267970420252725130199376407402483825008",
            "length": 571.0
        },
        "signature_version": "v1",
        "source": "https://github.com/gnome/libxml2/commit/09a2dd453007f9c7205274623acdd73747c22d64",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-54354-c5752451",
        "target": {
            "file": "xmlschemas.c"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "308981022804931015236413879421957310638",
                "282178084622988746890881910680625520695",
                "50271736739838765844818037174763357243",
                "198715064733683011505754465168917481346",
                "69219023379864035696646291254384072462"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/gnome/libxml2/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-54354-ef21c1eb",
        "target": {
            "file": "dict.c"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "19185847648471670323475216725842154505",
                "273593918359875311050534871051271330899",
                "160297338630813304163117051522217321186",
                "116158295440288060980015079180399826565"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/gnome/libxml2/commit/09a2dd453007f9c7205274623acdd73747c22d64",
        "signature_type": "Line"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54354.json"
vanir_signatures_modified 
"2026-08-30T08:13:43Z"