Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
Priority LOW 33CWE-776Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
Why it matters now
EPSS 0.02083 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nokogiri (RubyGems): 1.5.11, 1.6.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ruby | Nokogiri gem | 1.5.x; 1.6.x | — | No fix listed | CNA |
| — | nokogiri (RubyGems) | 1.5.0 to before 1.5.11 | 1.5.11 | Patch available | GHSA-62qp-3fxm-9wxf |
| — | nokogiri (RubyGems) | 1.6.0 to before 1.6.1 | 1.6.1 | Patch available | GHSA-62qp-3fxm-9wxf |
- Nokogiri gem Vendorruby Affected 1.5.x; 1.6.x Fixed in — No fix listed CNA
- nokogiri (RubyGems) Vendor— Affected 1.5.0 to before 1.5.11 Fixed in 1.5.11 Patch available GHSA-62qp-3fxm-9wxf
- nokogiri (RubyGems) Vendor— Affected 1.6.0 to before 1.6.1 Fixed in 1.6.1 Patch available GHSA-62qp-3fxm-9wxf
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:* | 1.5.0 to before 1.5.11; 1.6.0 to before 1.6.1 | Vulnerable | sparklemotion |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
- cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:* Versions 1.5.0 to before 1.5.11; 1.6.0 to before 1.6.1 Vulnerable ·sparklemotion
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-62qp-3fxm-9wxf nokogiri (RubyGems) Fixed in 1.5.11 Advisory →
- Fix · GHSA-62qp-3fxm-9wxf nokogiri (RubyGems) Fixed in 1.6.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 8 products
- CloudForms Management Engine 5
- OpenShift Enterprise 1
- Red Hat Enterprise MRG 2
- Red Hat OpenShift Enterprise 2
- Red Hat OpenStack Platform 3
- Red Hat OpenStack Platform 4
- Red Hat Satellite 6
- Red Hat Subscription Asset Manager
Timeline
- 2026-10-02 Threatist record created from CVE-2013-6460
- 2026-10-03 Alias added: GHSA-62qp-3fxm-9wxf
References
Advisory 5
More ruby vulnerabilities
- TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-50176 Use after free in ruby json CVSS 4.0HIGH 8.7
- TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
- TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
- TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
- TI-2025-18855 Net::IMAP vulnerable to possible DoS by memory exhaustion CVSS 3.1MEDIUM 6.5
Sources
- CVE-2013-6460 · CVE Program
- CVE-2013-6460 · NVD
- FIRST EPSS
- GHSA-62qp-3fxm-9wxf · GitHub Advisory Database · CC BY 4.0
- CVE-2013-6460 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences