CVE-2023-54354 in Nokogiri
Summary
by MITRE • 08/25/2026
Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified as CVE-2023-28484 affects versions of Nokogiri prior to release 1.14.3, specifically when utilizing the CRuby implementation bundled with libxml2 version 2.10.3. This issue stems from critical flaws within the XML Schema processing subsystem of the underlying libxml2 library. The core technical defect involves NULL pointer dereferences occurring during specific validation operations against complex types and structural consistency checks. Specifically, the functions xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK fail to adequately validate input data before accessing memory pointers associated with schema definitions. When an attacker supplies a crafted or malformed XML schema document that triggers these code paths without properly initialized type structures, the application attempts to dereference a NULL pointer. This results in an immediate segmentation fault, causing the process handling the XML parsing to crash unexpectedly.
From a security impact perspective, this vulnerability primarily facilitates Denial of Service attacks against applications relying on Nokogiri for XML processing. Because the flaw leads directly to a program termination via segmentation fault, any service or background job that processes untrusted XML schemas is at risk of becoming unavailable until restarted. While the primary consequence is availability loss rather than data exfiltration or remote code execution in this specific context, such crashes can be leveraged by adversaries to disrupt critical business operations or trigger cascading failures in systems with insufficient fault tolerance mechanisms. The vulnerability aligns with CWE-476, which describes a NULL Pointer Dereference, and maps to the ATT&CK technique T1499, specifically Endpoint Denial of Service via resource exhaustion through application crashes.
The root cause lies in the upstream libxml2 library's handling of complex type derivation rules during schema validation. The parser does not sufficiently check for null references before proceeding with structural integrity checks on derived types. This oversight allows malformed schemas to bypass standard error handling routines and reach low-level memory access operations that assume valid object states. Although Nokogiri acts as a wrapper, the bundled version of libxml2 contained this specific defect in versions up through 2.10.3. The issue is isolated to the CRuby implementation using the packaged library rather than system-installed or dynamically linked variants unless they also share the same vulnerable codebase state.
To mitigate this vulnerability, organizations must upgrade Nokogiri to version 1.14.3 or later. This release incorporates libxml2 v2.10.4, which includes patches for both xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK to ensure proper null checks are performed before pointer dereferencing. For environments where upgrading Nokogiri is not immediately feasible, implementing input validation at the application layer can provide a temporary defense-in-depth measure by rejecting malformed XML schemas before they reach the parser. Additionally, deploying runtime protection mechanisms such as core dump analysis tools or process supervisors that automatically restart crashed services can help maintain availability while patching efforts are underway. Regularly monitoring for updates to both Nokogiri and its dependencies is essential to prevent exposure to similar memory safety issues in future releases.