Bug 2523554 (CVE-2022-50999)

Summary: CVE-2022-50999 nokogiri: libxml2: Nokogiri: Integer overflow in libxml2 leads to information disclosure, data modification, or denial of service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akostadi, amasferr, anthomas, crizzo, dmayorov, ehelms, eshamard, ggainey, jlledo, jpasqual, juwatts, jvasik, kaycoth, mdellweg, mhulan, nmoumoul, osousa, pantinor, pcreech, rblanco, rchan, rhel-process-autobot, smallamp, tmalecek, tsedmik, watson-tool-maintainers, ytale
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Nokogiri. An integer overflow vulnerability in packaged libxml2 buffer handling functions allows a remote attacker to cause out-of-bounds memory writes. By crafting specially designed, large XML files, an attacker can trigger buffer overflows, leading to potential information disclosure, data modification, or denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-25 15:33:14 UTC 
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
Comment 1 Yadnyawalk Tale 2026-08-31 07:39:11 UTC 
* Why CVSS 7.0 (not 8.6) *

libxml2 requires a crafted multi-gigabyte XML file (>2 GB), which normal RH upload and request limits block in practice. AC:H reflects that barrier; C:L/I:L stay because out-of-bounds writes are still possible if those limits are bypassed. 7.0 is a modest drop from 8.6 without treating it as DoS-only.
Comment 4 Yadnyawalk Tale 2026-08-31 08:37:54 UTC 
.