CVE-2013-6461: Nokogiri vulnerable to DoS while parsing XML entities
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.83047%
CWE
Published
5/5/2022
Updated
6/30/2023
KEV Status
No
Technology
Ruby
RubyTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nokogiri | rubygems | >= 1.5.0, < 1.5.11 | 1.5.11 |
| nokogiri | rubygems | >= 1.6.0, < 1.6.1 | 1.6.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability (CWE-776) stems from Nokogiri's failure to apply limits on XML entity expansion, leading to DoS via recursive entity references. However, the provided data lacks specific code references, commit diffs, or patch details. While the issue likely resides in functions configuring libxml2 parser options (e.g., setting entity expansion limits), the exact function names and file paths cannot be confidently identified without examining the patched code changes. Thus, no functions are listed with high confidence.