# CVE-2021-3537: Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing

> CVE-2021-3537 (GitHub advisory GHSA-286v-pcf5-25rc) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.9, classed as NULL Pointer Dereference (CWE-476), in nokogiri (RubyGems). Affected versions: < 1.11.4. It is fixed in 1.11.4.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2021-3537

| Field | Value |
| --- | --- |
| CVE | CVE-2021-3537 |
| GHSA | GHSA-286v-pcf5-25rc |
| Severity | Medium |
| CVSS 3.1 | 5.9 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` (GitHub Advisory Database) |
| CWE | CWE-476 NULL Pointer Dereference |
| EPSS | 3.5% (higher than 88% of CVEs) |
| CISA KEV | Not listed |
| Published | 14 May 2021 |
| Modified | 3 Aug 2024 |

## Description

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| nokogiri | RubyGems | `pkg:gem/nokogiri` | < 1.11.4 | 1.11.4 |

## Questions

**What is the GHSA ID for CVE-2021-3537?**

GitHub tracks CVE-2021-3537 as GHSA-286v-pcf5-25rc.

**What is the CVSS score of CVE-2021-3537?**

CVE-2021-3537 has a CVSS 3.1 base score of 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

**Which versions are affected by CVE-2021-3537?**

nokogiri (RubyGems): < 1.11.4.

**How do I fix CVE-2021-3537?**

Upgrade to 1.11.4 or later.

**What is the Package URL (PURL) for CVE-2021-3537?**

The affected package's PURL is pkg:gem/nokogiri.

**Is CVE-2021-3537 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2021-3537. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 3.5% chance of exploitation in the next 30 days, higher than 88% of CVEs.

## References

- https://bugzilla.redhat.com/show_bug.cgi?id=1956522 (fix)
- https://www.oracle.com/security-alerts/cpuapr2022.html (fix)
- https://www.oracle.com/security-alerts/cpuoct2021.html (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2021-3537 (advisory)
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3537.yml (advisory)
- https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html (advisory)
- https://security.gentoo.org/glsa/202107-05 (advisory)
- https://security.netapp.com/advisory/ntap-20210625-0002 (advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/ (advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/ (advisory)
- https://github.com/advisories/GHSA-286v-pcf5-25rc (advisory)
- https://github.com/sparklemotion/nokogiri (package)
- https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV
- https://nokogiri.org/CHANGELOG.html#1114-2021-05-14
- https://www.oracle.com/security-alerts/cpujul2022.html

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2021-3537), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.