Skip to content
CVE IDCVE-2021-3537GitHub advisory IDGHSA-286v-pcf5-25rc

Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing

CVE-2021-3537 (GitHub advisory GHSA-286v-pcf5-25rc) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.9, classed as NULL Pointer Dereference (CWE-476), in nokogiri (RubyGems). Affected versions: < 1.11.4. It is fixed in 1.11.4.

Medium5.9Fix availableGitHub reviewed

Published 14 May 2021Updated 3 Aug 2024

5.9MediumCVSS 3.1
CVE ID
CVE-2021-3537
GHSA ID
GHSA-286v-pcf5-25rc
EPSS
3.5%higher than 88% of CVEs
Weakness (CWE)
KEV status
Not in KEV
Published
14 May 2021
Updated
3 Aug 2024
Ecosystem
  • RubyGems
Assigned by (CNA)
redhat

Summary

Source: OSV (GitHub advisory)

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Medium5.9Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
High
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
None
Integrity I
None
Availability A
High

Affected packages

Source: OSV (GitHub advisory)

  • nokogiri
    RubyGems
    pkg:gem/nokogiri
    Affected versions
    < 1.11.4
    Fixed in
    1.11.4
    Show 128 listed versions
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.1.0
    • 1.1.1
    • 1.10.0
    • 1.10.0.rc1

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 1.11.4 or later.

Vulnerability intelligence

References

Questions about CVE-2021-3537

What is the GHSA ID for CVE-2021-3537?
GitHub tracks CVE-2021-3537 as GHSA-286v-pcf5-25rc.
What is the CVSS score of CVE-2021-3537?
CVE-2021-3537 has a CVSS 3.1 base score of 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Which versions are affected by CVE-2021-3537?
nokogiri (RubyGems): < 1.11.4.
How do I fix CVE-2021-3537?
Upgrade to 1.11.4 or later.
What is the Package URL (PURL) for CVE-2021-3537?
The affected package's PURL is pkg:gem/nokogiri.
Is CVE-2021-3537 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2021-3537. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 3.5% chance of exploitation in the next 30 days, higher than 88% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 5 days ago (8 Oct 2026, 23:35 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.