{"id":"CVE-2025-71407","aliases":["GHSA-vvfq-8hwr-qm4m"],"url":"https://o3.security/vulnerability/CVE-2025-71407","summary":"Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free","details":"## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to [v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n   - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation errors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted XML Schemas (.xsd) and, potentially, validation of untrusted documents against trusted Schemas if they make use of `xsd:keyref` in combination with recursively defined types that have additional identity constraints.","published":"2026-08-25T15:15:59.250Z","modified":"2026-08-30T03:30:14.678203906Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"nokogiri","fixedVersion":"1.18.3"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71407.json"},{"type":"ADVISORY","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71407"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/nokogiri-before-stack-buffer-overflow-and-use-after-free"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-30T03:30:14.678203906Z"}}