CVE-2013-6461

Nokogiri, a popular Ruby library for parsing XML and HTML, versions 1.5.x and 1.6.x, is vulnerable to a denial-of-service (DoS) attack when parsing XML entities. The root cause is the failure to apply limits on entity expansion, allowing an attacker to cause resource exhaustion [4].

An attacker can exploit this vulnerability by providing a specially crafted XML document containing deeply nested or recursive entity references. This triggers uncontrolled expansion of entities, consuming excessive CPU time and memory. No authentication is required if the application parses untrusted XML input, making the attack surface broad [1][4].

Successful exploitation leads to a denial-of-service condition: the application may become unresponsive or crash due to memory exhaustion. This can disrupt services relying on Nokogiri to process XML data [1].

The issue has been addressed in later versions of Nokogiri. Users should upgrade to a patched release (e.g., versions after 1.6.x) to mitigate the vulnerability [2].