Nokogiri does not forbid namespace nodes in XPointer ranges

The core of this vulnerability lies in how Nokogiri, which relies on libxml2 for XML parsing, handles XPointer ranges. libxml2, prior to version 2.9.5, fails to prevent namespace nodes within these ranges, creating a scenario where an attacker can manipulate the XML structure to trigger a use-after-free condition. This can lead to arbitrary code execution, granting an attacker complete control over the affected system. Alternatively, the memory corruption caused by the vulnerability can result in a denial of service, crashing the application or the entire system. The impact is particularly severe because Nokogiri is widely used in Ruby applications for parsing and manipulating XML data, making a broad range of systems potentially vulnerable.

Ruby applications that rely on Nokogiri for XML parsing are at risk, particularly those processing untrusted XML data from external sources. Applications using older versions of Nokogiri in production environments, especially those with limited update cycles, are particularly vulnerable. Shared hosting environments where users have the ability to upload or process XML files are also at increased risk.

• ruby / gem: Check Nokogiri version using gem list nokogiri. If the version is less than 1.7.1, the system is vulnerable. • ruby / gem: Inspect application logs for errors related to XML parsing or libxml2. • generic web: Monitor web server access logs for unusual XML requests, particularly those utilizing XPointer syntax. • generic web: Use a web application firewall (WAF) to block requests containing potentially malicious XML payloads.

1. 2016-04-12Discovery

   discovery

2. 2018-08-21Disclosure

   disclosure

3. 2018-08-21PoC

   poc

4. 2018-08-21Patch

   patch

5. 2023-03-16CISA KEV

   kev

1. Publiée2018-08-21
2. Modifiée2024-02-16
3. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2016-4658 is to upgrade Nokogiri to version 1.7.1 or later. This version incorporates the fix from libxml2 2.9.5, which properly handles namespace nodes in XPointer ranges. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing input validation to sanitize XML documents before parsing. Specifically, restrict the use of XPointer ranges and carefully validate the structure of XML documents. While not a complete solution, this can reduce the attack surface. There are no specific WAF rules or detection signatures readily available for this vulnerability, emphasizing the importance of patching.