# CVE-2019-13117: Nokogiri uninitialized read in libxslt xsl:number processing

Source: https://junglewise.ai/threats/cve-2019-13117-nokogiri-uninitialized-read-in-libxslt-xsl-number-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-24. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2019-13117 · Severity: medium · CVSS 5.3 · Published 2022-05-24

Nokogiri is a popular Ruby library used for parsing and processing XML and HTML documents. A security flaw in its underlying processing engine could allow an attacker to read small amounts of sensitive information from the server's memory by providing specially crafted formatting strings. This could potentially lead to the exposure of internal data or help an attacker bypass other security measures.

Technologies: [Gnome Libxslt](https://junglewise.ai/threats/technologies/libxslt), [nokogiri (RubyGems)](https://junglewise.ai/threats/technologies/nokogiri). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2019-13117 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-13117 being exploited in the wild.

**How severe is CVE-2019-13117?** Medium severity, with a CVSS score of 5.3, published 24 May 2022.

**Which products and versions are affected?** Gnome Libxslt 1.1.33; nokogiri (RubyGems) < 1.10.5, ECOSYSTEM:introduced=0,fixed=1.10.5.

**Is there a fix for CVE-2019-13117?** Yes. nokogiri (RubyGems): upgrade to 1.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-13117 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-13117?** Check whether you run Gnome Libxslt or nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nokogiri (RubyGems): upgrade to 1.10.5 or later

  ```sh
  bundle update nokogiri
  ```


## Technical details

An uninitialized read vulnerability exists in libxslt (specifically in numbers.c) when processing xsl:number instructions with certain format strings. The root cause is located in the xsltNumberFormatInsertNumbers function, where a failure to initialize resources allows an attacker to infer the contents of bytes on the stack (such as identifying specific characters like 'A', 'a', 'I', 'i', or '0'). This is a network-reachable vulnerability requiring no authentication or user interaction. While the information leak is limited in scope per request, it can be used to bypass memory protections or leak sensitive stack data. The issue is addressed in Nokogiri version 1.10.5 by updating the bundled libxslt dependency.

## Affected products

- Nokogiri Nokogiri < 1.10.5
- GNOME libxslt 1.1.33

## Identifiers

- CVE-2019-13117
- GHSA-4hm9-844j-jmxp

## Timeline

- 2019-07-01: disclosed: NVD publication date
- 2019-10-22: patched: Nokogiri v1.10.5 released with fix
- 2022-05-24: advisory: GitHub Advisory published

## References

- [https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471)
- [https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1](https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1)
- [https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E](https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E)
- [https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E](https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E)
- [https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html](https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html)

## Related threats

- [Nokogiri use-after-free in attribute replacement](https://junglewise.ai/threats/cve-2026-126064-nokogiri-is-an-open-source-xml-and-html-library-for-the-ruby)
- [Nokogiri HTML5 serializer mutation XSS via noscript and attributes](https://junglewise.ai/threats/cve-2026-126063-nokogiri-is-an-open-source-xml-and-html-library-for-the-ruby)
- [JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host](https://junglewise.ai/threats/cve-2026-126062-nokogiri-is-an-open-source-xml-and-html-library-for-the-ruby)
- [Nokogiri unchecked return value in canonicalize method](https://junglewise.ai/threats/nokogiri-unchecked-return-value-in-canonicalize-method-3863de91)
- [Nokogiri XSLT transform memory leak](https://junglewise.ai/threats/nokogiri-xslt-transform-memory-leak-0441ddf7)