How severe is CVE-2024-58378?

No CVSS score has been assigned to CVE-2024-58378 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2024-58378?

CVE-2024-58378 affects the following packages: nokogiri (RubyGems), nokogiri (RubyGems). Ecosystems affected: RubyGems.

How do I fix CVE-2024-58378?

Update nokogiri to 1.16.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-58378 is resolved across your whole dependency graph.

How do I detect CVE-2024-58378 in my RubyGems dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2024-58378 if there is no patch (or I can't update yet)?

Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Is CVE-2024-58378 actively exploited in the wild?

No public exploit code has been indexed for CVE-2024-58378 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was CVE-2024-58378 published, and has it been updated?

CVE-2024-58378 was published on August 25, 2026 and was last updated on August 30, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

💎 RubyGems

Not in CISA KEV

CVE-2024-58378 — nokogiri

Fix: GNOME/libxml2@9272197

CVE-2024-58378 is a security vulnerability in nokogiri. A fix is available for nokogiri — see the affected versions and patch details below.

Nokogiri before 1.16.2 Use-After-Free via xmlTextReader

Also known asGHSA-xc9x-jj77-9p9j

Published

Aug 25, 2026

Updated

Aug 30, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Aug 30, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

💎nokogiri💎nokogiri

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Nokogiri upgrades its dependency libxml2 as follows:

Nokogiri v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
Nokogiri v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4

libxml2 v2.11.7 and v2.12.5 address the following vulnerability:

CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970

Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if the packaged libraries are being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.

JRuby users are not affected.

Mitigation

Upgrade to Nokogiri ~> 1.15.6 or >= 1.16.2.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against patched external libxml2 libraries which will also address these same issues.

Impact

From the CVE description, this issue applies to the xmlTextReader module (which underlies Nokogiri::XML::Reader):

When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Timeline

2024-02-04 10:35 EST - this GHSA is drafted without complete details about when the upstream issue was introduced; a request is made of libxml2 maintainers for more detailed information
2024-02-04 10:48 EST - updated GHSA to reflect libxml2 maintainers' confirmation of affected versions
2024-02-04 11:54 EST - v1.16.2 published, this GHSA made public
2024-02-05 10:18 EST - updated with MITRE link to the CVE information, and updated "Impact" section
2024-03-16 09:03 EDT - v1.15.6 published (see discussion at https://github.com/sparklemotion/nokogiri/discussions/3146), updated mitigation information
2024-03-18 22:12 EDT - update "affected products" range with v1.15.6 information

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
💎RubyGems	`nokogiri`	≥ 1.16.0&&< 1.16.2	1.16.2`bundle update nokogiri --conservative`
💎RubyGems	`nokogiri`	all versions	1.15.6`bundle update nokogiri --conservative`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update nokogiri to 1.16.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-58378 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This CVE does not represent a flaw in Nokogiri, but is rather a duplicate assignment for different CVEs affecting libxml2 or libxslt. The rubygem-nokogiri packages as shipped in Red Hat products do not bundled libxml2 and libxslt, but rather use system packages of those libraries. This CVE is therefore not applicable…

Workaround published by Red Hat

Upgrade Nokogiri to 1.15.6 or to 1.16.2 or later. If upgrading is not possible, compile and link Nokogiri against patched external libxml2 libraries. Installations using system libxml2 and JRuby users are not affected by this advisory.

Source: Red Hat security advisory for CVE-2024-58378 (CC BY 4.0)

Frequently Asked Questions

## Summary Nokogiri upgrades its dependency libxml2 as follows: - Nokogiri v1.15.6 upgrades libxml2 to [2.11.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.7) from 2.11.6 - Nokogiri v1.16.2 upgrades libxml2 to [2.12.5](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5) from 2.12.4 libxml2 v2.11.7 and v2.12.5 address the following vulnerability: - CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062 - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604 - patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970 Please

O3 Security · Impact-Aware SCA

Is CVE-2024-58378 in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works