{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54354", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-10T01:51:52.987Z", "datePublished": "2026-08-25T15:15:55.858Z", "dateUpdated": "2026-08-28T15:18:24.047Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-28T15:18:24.047Z"}, "datePublic": "2023-04-11T00:00:00.000Z", "title": "Nokogiri before 1.14.3 Null Pointer Dereference via libxml2", "descriptions": [{"lang": "en", "value": "Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "NULL Pointer Dereference", "cweId": "CWE-476", "type": "CWE"}]}], "affected": [{"vendor": "sparklemotion", "product": "nokogiri", "defaultStatus": "unaffected", "packageURL": "pkg:gem/nokogiri", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.14.3"}, {"version": "1.14.3", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.14.3"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-pxvg-2qj5-37jq)"}, {"url": "https://github.com/GNOME/libxml2/commit/09a2dd453007f9c7205274623acdd73747c22d64", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/GNOME/libxml2/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/GNOME/libxml2/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6", "tags": ["patch"], "name": "Patch Commit"}, {"name": "VulnCheck Advisory: Nokogiri before 1.14.3 Null Pointer Dereference via libxml2", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/nokogiri-before-null-pointer-dereference-via-libxml2"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T16:11:24.833421Z", "id": "CVE-2023-54354", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T16:12:06.863Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T16:11:24.833421Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T16:12:03.131Z"}}], "cna": {"title": "Nokogiri before 1.14.3 Null Pointer Dereference via libxml2", "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sparklemotion", "product": "nokogiri", "versions": [{"status": "affected", "version": "0", "lessThan": "1.14.3", "versionType": "semver"}, {"status": "unaffected", "version": "1.14.3", "versionType": "semver"}], "packageURL": "pkg:gem/nokogiri", "defaultStatus": "unaffected"}], "datePublic": "2023-04-11T00:00:00.000Z", "references": [{"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq", "name": "GitHub Security Advisory (GHSA-pxvg-2qj5-37jq)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/GNOME/libxml2/commit/09a2dd453007f9c7205274623acdd73747c22d64", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/GNOME/libxml2/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/GNOME/libxml2/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/nokogiri-before-null-pointer-dereference-via-libxml2", "name": "VulnCheck Advisory: Nokogiri before 1.14.3 Null Pointer Dereference via libxml2", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "NULL Pointer Dereference"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.14.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-28T15:18:24.047Z"}}}, "cveMetadata": {"cveId": "CVE-2023-54354", "state": "PUBLISHED", "dateUpdated": "2026-08-28T15:18:24.047Z", "dateReserved": "2026-01-10T01:51:52.987Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-25T15:15:55.858Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:gem/nokogiri", "product": "nokogiri", "vendor": "sparklemotion", "versions": [{"lessThan": "1.14.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.14.3", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "787048D8-2151-450E-9285-E090C1710C12", "versionEndExcluding": "1.14.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues."}], "id": "CVE-2023-54354", "lastModified": "2026-09-01T19:40:15.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54354", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T16:11:24.833421Z", "version": "2.0.3"}}]}, "published": "2026-08-25T16:16:44.543", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/GNOME/libxml2/commit/09a2dd453007f9c7205274623acdd73747c22d64"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/GNOME/libxml2/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/GNOME/libxml2/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f"}, {"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory", "Mitigation"], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/nokogiri-before-null-pointer-dereference-via-libxml2"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nokogiri: libxml2: Nokogiri: Denial of Service via crafted XML schema", "id": "2523569", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523569"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.", "A flaw was found in Nokogiri, specifically in its bundled libxml2 library when processing XML schemas. An attacker can exploit this by providing a specially crafted XML schema, leading to a NULL pointer dereference. This can cause the application to crash, resulting in a denial of service."], "name": "CVE-2023-54354", "package_state": [{"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/backend-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/toolbox-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "rubygem-nokogiri", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "tfm-rubygem-amazing_print", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "tfm-rubygem-graphql", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-08-25T15:15:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-54354\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54354\nhttps://github.com/sparklemotion/nokogiri/commit/09a2dd453007f9c7205274623acdd73747c22d64\nhttps://github.com/sparklemotion/nokogiri/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6\nhttps://github.com/sparklemotion/nokogiri/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f\nhttps://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq\nhttps://www.vulncheck.com/advisories/nokogiri-before-null-pointer-dereference-via-libxml2"], "threat_severity": "Important"}