Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
Priority LOW 33CWE-776Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
Why it matters now
EPSS 0.02194 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nokogiri (RubyGems): 1.5.11, 1.6.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ruby | Nokogiri gem | 1.5.x; 1.6.x | — | No fix listed | CNA |
| — | nokogiri (RubyGems) | 1.5.0 to before 1.5.11 | 1.5.11 | Patch available | GHSA-jmhh-w7xp-wg39 |
| — | nokogiri (RubyGems) | 1.6.0 to before 1.6.1 | 1.6.1 | Patch available | GHSA-jmhh-w7xp-wg39 |
- Nokogiri gem Vendorruby Affected 1.5.x; 1.6.x Fixed in — No fix listed CNA
- nokogiri (RubyGems) Vendor— Affected 1.5.0 to before 1.5.11 Fixed in 1.5.11 Patch available GHSA-jmhh-w7xp-wg39
- nokogiri (RubyGems) Vendor— Affected 1.6.0 to before 1.6.1 Fixed in 1.6.1 Patch available GHSA-jmhh-w7xp-wg39
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:* | 1.5.0 to before 1.5.11; 1.6.0 to before 1.6.1 | Vulnerable | sparklemotion |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
- cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:* Versions 1.5.0 to before 1.5.11; 1.6.0 to before 1.6.1 Vulnerable ·sparklemotion
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-jmhh-w7xp-wg39 nokogiri (RubyGems) Fixed in 1.5.11 Advisory →
- Fix · GHSA-jmhh-w7xp-wg39 nokogiri (RubyGems) Fixed in 1.6.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 8 products
- CloudForms Management Engine 5
- OpenShift Enterprise 1
- Red Hat Enterprise MRG 2
- Red Hat OpenShift Enterprise 2
- Red Hat OpenStack Platform 3
- Red Hat OpenStack Platform 4
- Red Hat Satellite 6
- Red Hat Subscription Asset Manager
Timeline
- 2026-10-02 Threatist record created from CVE-2013-6461
- 2026-10-03 Alias added: GHSA-jmhh-w7xp-wg39
References
Advisory 4
More ruby vulnerabilities
- TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-50176 Use after free in ruby json CVSS 4.0HIGH 8.7
- TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
- TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
- TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
- TI-2025-18855 Net::IMAP vulnerable to possible DoS by memory exhaustion CVSS 3.1MEDIUM 6.5
Sources
- CVE-2013-6461 · CVE Program
- CVE-2013-6461 · NVD
- FIRST EPSS
- GHSA-jmhh-w7xp-wg39 · GitHub Advisory Database · CC BY 4.0
- CVE-2013-6461 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences