GHSA-jw9f-hh49-cvp9 · Severity: high · Ecosystem: rubygems — Nokogiri contains libxml Out-of-bounds Write vulnerability
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
Conclusion & alert: CVE-2021-3517 is rated Moderate Risk (42/100): CVSS High severity, with low exploitation likelihood (EPSS 0.08%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-11-21 | 1.20% | 0.08% | -1.12% |
| 2 | 2025-11-18 | 0.08% | 1.20% | +1.12% |
| 3 | 2025-03-17 | — | 0.08% | — |
Full EPSS history (22 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 8.6 | 3.1 | HIGH |
|
3.9 | 4.7 | [email protected] |
| 8.6 | 3.1 | HIGH |
|
3.9 | 4.7 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| 7.5 | 2.0 | HIGH |
|
10.0 | 6.4 | [email protected] |
GHSA-jw9f-hh49-cvp9 · Severity: high · Ecosystem: rubygems — Nokogiri contains libxml Out-of-bounds Write vulnerability
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2021-3517: 3 source package rows (libxml2, libxml2.13, qt5-qtwebengine); 57 state rows across 17 repos (3.10-main, 3.11-main, 3.12-main, 3.17-community, 3.17-main, 3.18-community, 3.18-main, 3.19-community, 3.19-main, 3.20-community, 3.20-main, 3.21-community, 3.21-main, 3.22-community, 3.22-main, edge-community, edge-main); fixed 18, open 39. | https://security.alpinelinux.org/vuln/CVE-2021-3517 |
debian
|
not yet assigned | CVE-2021-3517 not yet assigned priority: Debian including 1 source packages (libxml2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2021-3517 |
gentoo
|
low | CVE-2021-3517: 1 GLSA(s) (202107-05), 1 atom(s) (dev-libs/libxml2); latest impact low. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2021-3517 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-3517 |
suse
|
high | CVE-2021-3517 severity important: SUSE including 433 source package names (0.1.0:libxml2-2-2.9.7-3.34.1, 0.1.75:libxml2-2-2.9.7-3.34.1, …), 663 product×package rows across 216 product lines (Container bci/bci-init, Container bci/dotnet-aspnet, … (216 product lines)): Fixed 517, Known Affected 137, Known Not Affected 9. | https://www.suse.com/security/cve/CVE-2021-3517/ |
ubuntu
|
medium | CVE-2021-3517 medium priority: Ubuntu including 1 source packages (libxml2), 9 status rows across 9 suites (bionic, focal, groovy, hirsute, impish, jammy, trusty, upstream, xenial): released 7, not-affected 2. | https://ubuntu.com/security/CVE-2021-3517 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| xmlsoft | libxml2 | < 2.9.11 | cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* |
| redhat | jboss_core_services | — | cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 8.0 | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| fedoraproject | fedora | 33 | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| fedoraproject | fedora | 34 | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| debian | debian_linux | 9.0 | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| netapp | active_iq_unified_manager | — | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
| netapp | active_iq_unified_manager | — | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* |
| netapp | clustered_data_ontap | — | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| netapp | clustered_data_ontap_antivirus_connector | — | cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* |
| netapp | e-series_santricity_os_controller | >= 11.0.0, <= 11.70.1 | cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* |
| netapp | e-series_santricity_storage_manager | — | cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* |
| netapp | e-series_santricity_web_services | — | cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* |
| netapp | hci_management_node | — | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| netapp | manageability_software_development_kit | — | cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* |
| netapp | oncommand_insight | — | cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
| netapp | oncommand_workflow_automation | — | cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* |
| netapp | ontap_select_deploy_administration_utility | — | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| netapp | santricity_unified_manager | — | cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:* |
| netapp | snapdrive | — | cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:* |
| netapp | snapmanager | — | cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* |
| netapp | snapmanager | — | cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* |
| netapp | solidfire | — | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| netapp | hci_h410c_firmware | — | cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* |
| oracle | enterprise_manager_base_platform | 13.4.0.0 | cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* |
| oracle | enterprise_manager_base_platform | 13.5.0.0 | cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* |
| oracle | mysql_workbench | <= 8.0.26 | cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* |
| oracle | openjdk | 8 | cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:* |
| oracle | peoplesoft_enterprise_peopletools | 8.58 | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* |
| oracle | real_user_experience_insight | 13.4.1.0 | cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:* |
| oracle | real_user_experience_insight | 13.5.1.0 | cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:* |
| oracle | zfs_storage_appliance_kit | 8.8 | cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* |