CVE-2015-1819: Nokogiri vulnerable to libxml XML Entity Expansion
5
CVSS Score
Basic Information
CVE ID
GHSA ID
EPSS Score
0.84568%
CWE
Published
8/8/2018
Updated
8/25/2023
KEV Status
No
Technology
Ruby
RubyTechnical Details
CVSS Vector
AV:N/AC:L/Au:N/C:N/I:N/A:P
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nokogiri | rubygems | >= 1.6.6.0, <= 1.6.6.3 | 1.6.6.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The CVE-2015-1819 patch modifies xmlTextReaderRead in libxml2's xmlreader.c to enforce memory constraints via XML_PARSE_HUGE. This function is the primary XML reader interface that processes document content incrementally. The vulnerability manifests when parsing malicious XML with recursive entity expansions without proper memory restrictions. The added flag enforcement in this function directly addresses the memory consumption issue, confirming it as the vulnerable entry point.