Denial of Service in Nokogiri Gem Affecting Ruby Applications

CVE-2013-6460

What is CVE-2013-6460?

The Nokogiri gem version 1.5.x is susceptible to a Denial of Service (DoS) vulnerability due to an infinite loop that occurs when improperly formed XML documents are parsed. This issue can be exploited by crafting specific XML inputs, which could cause applications relying on the Nokogiri gem to become unresponsive, potentially leading to downtime and disruption of services. Developers using Nokogiri should ensure their applications include proper input validation and update to a patched version of the gem to mitigate this risk.

References