{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47996.json"
      }
    ],
    "title": "nokogiri: libxml2: Nokogiri: Memory Corruption via Crafted XML Documents",
    "tracking": {
      "current_release_date": "2026-09-08T09:53:56+00:00",
      "generator": {
        "date": "2026-09-08T09:53:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "CVE-2021-47996",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2021-01-01T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-07T17:06:02+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-09-08T09:53:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat 3scale API Management Platform 2",
                "product": {
                  "name": "Red Hat 3scale API Management Platform 2",
                  "product_id": "red_hat_3scale_api_management_platform_2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:red_hat_3scale_amp:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat 3scale API Management Platform 2"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "red_hat_hardened_images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6",
                "product": {
                  "name": "Red Hat Satellite 6",
                  "product_id": "red_hat_satellite_6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite 6"
          },
          {
            "category": "product_version",
            "name": "3scale-amp2/backend-rhel8",
            "product": {
              "name": "3scale-amp2/backend-rhel8",
              "product_id": "3scale-amp2/backend-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/backend-rhel8?repository_url=registry.redhat.io/3scale-amp2/backend-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "3scale-amp2/system-rhel8",
            "product": {
              "name": "3scale-amp2/system-rhel8",
              "product_id": "3scale-amp2/system-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/system-rhel8?repository_url=registry.redhat.io/3scale-amp2/system-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "3scale-amp2/system-rhel9",
            "product": {
              "name": "3scale-amp2/system-rhel9",
              "product_id": "3scale-amp2/system-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/system-rhel9?repository_url=registry.redhat.io/3scale-amp2/system-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "3scale-amp2/toolbox-rhel9",
            "product": {
              "name": "3scale-amp2/toolbox-rhel9",
              "product_id": "3scale-amp2/toolbox-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/toolbox-rhel9?repository_url=registry.redhat.io/3scale-amp2/toolbox-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "3scale-amp2/zync-rhel9",
            "product": {
              "name": "3scale-amp2/zync-rhel9",
              "product_id": "3scale-amp2/zync-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/zync-rhel9?repository_url=registry.redhat.io/3scale-amp2/zync-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libxml2.src",
            "product": {
              "name": "libxml2.src",
              "product_id": "libxml2.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libxml2?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "swift-lang.src",
            "product": {
              "name": "swift-lang.src",
              "product_id": "swift-lang.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/swift-lang?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rubygem-nokogiri.src",
            "product": {
              "name": "rubygem-nokogiri.src",
              "product_id": "rubygem-nokogiri.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.17.2-3.el9sat?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tfm-rubygem-amazing_print.src",
            "product": {
              "name": "tfm-rubygem-amazing_print.src",
              "product_id": "tfm-rubygem-amazing_print.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tfm-rubygem-amazing_print?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tfm-rubygem-amazing_print",
            "product": {
              "name": "tfm-rubygem-amazing_print",
              "product_id": "tfm-rubygem-amazing_print",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tfm-rubygem-amazing_print"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tfm-rubygem-graphql.src",
            "product": {
              "name": "tfm-rubygem-graphql.src",
              "product_id": "tfm-rubygem-graphql.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tfm-rubygem-graphql?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tfm-rubygem-graphql",
            "product": {
              "name": "tfm-rubygem-graphql",
              "product_id": "tfm-rubygem-graphql",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tfm-rubygem-graphql"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/backend-rhel8 as a component of Red Hat 3scale API Management Platform 2",
          "product_id": "red_hat_3scale_api_management_platform_2:3scale-amp2/backend-rhel8"
        },
        "product_reference": "3scale-amp2/backend-rhel8",
        "relates_to_product_reference": "red_hat_3scale_api_management_platform_2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/system-rhel8 as a component of Red Hat 3scale API Management Platform 2",
          "product_id": "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8"
        },
        "product_reference": "3scale-amp2/system-rhel8",
        "relates_to_product_reference": "red_hat_3scale_api_management_platform_2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/system-rhel9 as a component of Red Hat 3scale API Management Platform 2",
          "product_id": "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9"
        },
        "product_reference": "3scale-amp2/system-rhel9",
        "relates_to_product_reference": "red_hat_3scale_api_management_platform_2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/toolbox-rhel9 as a component of Red Hat 3scale API Management Platform 2",
          "product_id": "red_hat_3scale_api_management_platform_2:3scale-amp2/toolbox-rhel9"
        },
        "product_reference": "3scale-amp2/toolbox-rhel9",
        "relates_to_product_reference": "red_hat_3scale_api_management_platform_2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/zync-rhel9 as a component of Red Hat 3scale API Management Platform 2",
          "product_id": "red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9"
        },
        "product_reference": "3scale-amp2/zync-rhel9",
        "relates_to_product_reference": "red_hat_3scale_api_management_platform_2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2.src as a component of Red Hat Hardened Images",
          "product_id": "red_hat_hardened_images:libxml2.src"
        },
        "product_reference": "libxml2.src",
        "relates_to_product_reference": "red_hat_hardened_images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "swift-lang.src as a component of Red Hat Hardened Images",
          "product_id": "red_hat_hardened_images:swift-lang.src"
        },
        "product_reference": "swift-lang.src",
        "relates_to_product_reference": "red_hat_hardened_images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-nokogiri.src as a component of Red Hat Satellite 6",
          "product_id": "red_hat_satellite_6:rubygem-nokogiri.src"
        },
        "product_reference": "rubygem-nokogiri.src",
        "relates_to_product_reference": "red_hat_satellite_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-amazing_print as a component of Red Hat Satellite 6",
          "product_id": "red_hat_satellite_6:tfm-rubygem-amazing_print"
        },
        "product_reference": "tfm-rubygem-amazing_print",
        "relates_to_product_reference": "red_hat_satellite_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-amazing_print.src as a component of Red Hat Satellite 6",
          "product_id": "red_hat_satellite_6:tfm-rubygem-amazing_print.src"
        },
        "product_reference": "tfm-rubygem-amazing_print.src",
        "relates_to_product_reference": "red_hat_satellite_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-graphql as a component of Red Hat Satellite 6",
          "product_id": "red_hat_satellite_6:tfm-rubygem-graphql"
        },
        "product_reference": "tfm-rubygem-graphql",
        "relates_to_product_reference": "red_hat_satellite_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-graphql.src as a component of Red Hat Satellite 6",
          "product_id": "red_hat_satellite_6:tfm-rubygem-graphql.src"
        },
        "product_reference": "tfm-rubygem-graphql.src",
        "relates_to_product_reference": "red_hat_satellite_6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-47996",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-25T15:32:05.703195+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_3scale_api_management_platform_2:3scale-amp2/backend-rhel8",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/toolbox-rhel9",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9",
            "red_hat_satellite_6:rubygem-nokogiri.src"
          ]
        },
        {
          "label": "component_not_present",
          "product_ids": [
            "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8",
            "red_hat_hardened_images:libxml2.src",
            "red_hat_hardened_images:swift-lang.src",
            "red_hat_satellite_6:tfm-rubygem-amazing_print",
            "red_hat_satellite_6:tfm-rubygem-amazing_print.src",
            "red_hat_satellite_6:tfm-rubygem-graphql",
            "red_hat_satellite_6:tfm-rubygem-graphql.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2523549"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Nokogiri, specifically within its bundled libxml2 library. A remote attacker could exploit multiple vulnerabilities, including memory leaks, buffer over-reads, heap-based buffer overflows, and out-of-bounds reads, by processing specially crafted XML documents. This could lead to memory corruption, information disclosure, or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nokogiri: libxml2: Nokogiri: Memory Corruption via Crafted XML Documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Red Hat products utilizing Nokogiri are affected by multiple vulnerabilities in its bundled libxml2 library, which can lead to denial of service, information disclosure, or memory corruption when processing specially crafted XML documents. While Nokogiri's default parse options prevent exponential entity expansion attacks, other flaws remain.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "red_hat_3scale_api_management_platform_2:3scale-amp2/backend-rhel8",
          "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8",
          "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9",
          "red_hat_3scale_api_management_platform_2:3scale-amp2/toolbox-rhel9",
          "red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9",
          "red_hat_hardened_images:libxml2.src",
          "red_hat_hardened_images:swift-lang.src",
          "red_hat_satellite_6:rubygem-nokogiri.src",
          "red_hat_satellite_6:tfm-rubygem-amazing_print",
          "red_hat_satellite_6:tfm-rubygem-amazing_print.src",
          "red_hat_satellite_6:tfm-rubygem-graphql",
          "red_hat_satellite_6:tfm-rubygem-graphql.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-47996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2523549",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523549"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-47996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-47996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-47996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47996"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5",
          "url": "https://github.com/sparklemotion/nokogiri/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/commit/1098c30a040e72a4654968547f415be4e4c40fe7",
          "url": "https://github.com/sparklemotion/nokogiri/commit/1098c30a040e72a4654968547f415be4e4c40fe7"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/commit/1358d157d0bd83be1dfe356a69213df9fac0b539",
          "url": "https://github.com/sparklemotion/nokogiri/commit/1358d157d0bd83be1dfe356a69213df9fac0b539"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2",
          "url": "https://github.com/sparklemotion/nokogiri/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a",
          "url": "https://github.com/sparklemotion/nokogiri/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/commit/8598060bacada41a0eb09d95c97744ff4e428f8e",
          "url": "https://github.com/sparklemotion/nokogiri/commit/8598060bacada41a0eb09d95c97744ff4e428f8e"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/commit/babe75030c7f64a37826bb3342317134568bef61",
          "url": "https://github.com/sparklemotion/nokogiri/commit/babe75030c7f64a37826bb3342317134568bef61"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2",
          "url": "https://github.com/sparklemotion/nokogiri/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2"
        },
        {
          "category": "external",
          "summary": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64",
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/nokogiri-before-multiple-vulnerabilities-via-libxml2",
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-multiple-vulnerabilities-via-libxml2"
        }
      ],
      "release_date": "2026-08-25T15:15:53.158000+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "red_hat_3scale_api_management_platform_2:3scale-amp2/backend-rhel8",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/toolbox-rhel9",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9",
            "red_hat_hardened_images:libxml2.src",
            "red_hat_hardened_images:swift-lang.src",
            "red_hat_satellite_6:rubygem-nokogiri.src",
            "red_hat_satellite_6:tfm-rubygem-amazing_print",
            "red_hat_satellite_6:tfm-rubygem-amazing_print.src",
            "red_hat_satellite_6:tfm-rubygem-graphql",
            "red_hat_satellite_6:tfm-rubygem-graphql.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "red_hat_3scale_api_management_platform_2:3scale-amp2/backend-rhel8",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/toolbox-rhel9",
            "red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9",
            "red_hat_hardened_images:libxml2.src",
            "red_hat_hardened_images:swift-lang.src",
            "red_hat_satellite_6:rubygem-nokogiri.src",
            "red_hat_satellite_6:tfm-rubygem-amazing_print",
            "red_hat_satellite_6:tfm-rubygem-amazing_print.src",
            "red_hat_satellite_6:tfm-rubygem-graphql",
            "red_hat_satellite_6:tfm-rubygem-graphql.src"
          ]
        }
      ],
      "title": "nokogiri: libxml2: Nokogiri: Memory Corruption via Crafted XML Documents"
    }
  ]
}