CVE-2025-71407

rubygem-nokogiri: Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free

Published Aug 25, 2026 CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected as a duplicate.

No data.

No data available yet.

No solution or workaround provided in the CVE record

No advisories available

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m
https://nvd.nist.gov/vuln/detail/CVE-2025-71407
https://www.cve.org/CVERecord?id=CVE-2025-71407
https://www.vulncheck.com/advisories/nokogiri-before-stack-buffer-overflow-and-use-after-free

History

Type	Values Removed	Values Added
Title		rubygem-nokogiri: Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free
Weaknesses		CWE-121
References		https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m https://nvd.nist.gov/vuln/detail/CVE-2025-71407 https://www.cve.org/CVERecord?id=CVE-2025-71407 https://www.vulncheck.com/advisories/nokogiri-before-stack-buffer-overflow-and-use-after-free
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}` threat_severity `Important`

Type	Values Removed	Values Added
Description	Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.	This CVE ID has been rejected as a duplicate.
Title	Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free
Weaknesses	CWE-787
CPEs	cpe:2.3:a:nokogiri:nokogiri::::::::
References	https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m https://www.vulncheck.com/advisories/nokogiri-before-stack-buffer-overflow-and-use-after-free
Metrics	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.
Title		Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free
First Time appeared		Nokogiri Nokogiri nokogiri
Weaknesses		CWE-787
CPEs		cpe:2.3:a:nokogiri:nokogiri::::::::
Vendors & Products		Nokogiri Nokogiri nokogiri
References		https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m https://www.vulncheck.com/advisories/nokogiri-before-stack-buffer-overflow-and-use-after-free
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`