Description
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sparklemotion | nokogiri | < 1.13.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-nokogiri | 1.13.5+dfsg-1 | — |
| Debian 13 | ruby-nokogiri | 1.13.5+dfsg-1 | — |
| Debian 12 | ruby-nokogiri | 1.13.5+dfsg-1 | — |
| Debian 11 | ruby-nokogiri | 1.11.1+dfsg-2+deb11u1 | DLA-3868-1 |
| Debian 10 | ruby-nokogiri | 1.10.0+dfsg1-2+deb10u1 | DLA-3149-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | ruby-nokogiri | 1.6.8.1-1+deb9u2 | DLA-3003-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ruby-nokogiri | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-nokogiri | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ruby-nokogiri | No fix yet | — |
| Ubuntu Pro 20.04 LTS | ruby-nokogiri | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ruby-nokogiri | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | candlepin +1 | 4.1.15-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | foreman +13 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-git | 1.11.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-rails-html-sanitizer | 1.4.3-2.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:8506 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | rubygem-nokogiri | 1.8.5-150400.14.3.1 | SUSE-SU-2022:4016-1 |
| SLES 15 SP3 | rubygem-nokogiri | 1.8.5-150000.3.9.1 | SUSE-SU-2022:4015-1 |
| SLES 15 SP2 | rubygem-nokogiri | 1.8.5-150000.3.9.1 | SUSE-SU-2022:4015-1 |
| SLES 15 SP1 | rubygem-nokogiri | 1.8.5-150000.3.9.1 | SUSE-SU-2022:4015-1 |
| SLES 15 | rubygem-nokogiri | 1.8.5-150000.3.9.1 | SUSE-SU-2022:4015-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | rubygem-nokogiri | 1.6.1-5.6.1 | SUSE-SU-2022:3890-1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-nokogiri | 1.6.1-5.6.1 | SUSE-SU-2022:3890-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-nokogiri | 1.13.9-1.7 | openSUSE-SU-2024:13165-1 |
| openSUSE Tumbleweed | rubygem-nokogiri | 1.13.4-1.1 | openSUSE-SU-2026:10356-1, openSUSE-SU-2025:14697-1, openSUSE-SU-2024:14174-1 |
| openSUSE Leap 15.4 | rubygem-nokogiri | 1.8.5-150400.14.3.1 | SUSE-SU-2022:4016-1 |
| openSUSE Leap 15.3 | rubygem-nokogiri | 1.8.5-150000.3.9.1 | SUSE-SU-2022:4015-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ruby-nokogiri | 1.13.4-r0 | — |
| Alpine v3.23 | ruby-nokogiri | 1.13.4-r0 | — |
| Alpine v3.22 | ruby-nokogiri | 1.13.4-r0 | — |
| Alpine v3.21 | ruby-nokogiri | 1.13.4-r0 | — |
| Alpine v3.20 | ruby-nokogiri | 1.13.4-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | ruby-nokogiri | 1.13.4-r0 | — |
| Alpine v3.18 | ruby-nokogiri | 1.13.4-r0 | — |
| Alpine v3.17 | ruby-nokogiri | 1.13.4-r0 | — |
| Alpine v3.16 | ruby-nokogiri | 1.13.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | nokogiri | < 1.13.4 | 1.13.4 | GHSA-crjr-9rc5-ghw8 |
Advisories 14
- RHSA-2022:8506 Red Hat Security Advisory: Satellite 6.12 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2026:10356-1 ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- DLA-3868-1 ruby-nokogiri - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3149-1 ruby-nokogiri - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3003-1 ruby-nokogiri - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:8506 Important: Satellite 6.12 Release Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2025:14697-1 ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13165-1 ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11999-1 ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4015-1 Security update for rubygem-nokogiri SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14174-1 ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4016-1 Security update for rubygem-nokogiri SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3890-1 Security update for rubygem-nokogiri SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-2313 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 31, 2024
References
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
- https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd
- FEDORA-2022-9ed7641ce0 vendor-advisory
- FEDORA-2022-132c6d7c2e vendor-advisory
- FEDORA-2022-d231cb5e1f vendor-advisory
- [debian-lts-announce] 20220513 [SECURITY] [DLA 3003-1] ruby-nokogiri security update mailing-list
- GLSA-202208-29 vendor-advisory
- [debian-lts-announce] 20221012 [SECURITY] [DLA 3149-1] ruby-nokogiri security update mailing-list
- https://support.apple.com/kb/HT213532
- 20221220 APPLE-SA-2022-12-13-4 macOS Ventura 13.1 mailing-list