CVE-2025-71407
CriticalCVSS 9.8Summary
Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.
Risk Assessment
The vulnerabilities may lead to application crashes (denial of service) or potential remote code execution, posing a serious threat to system availability and security.
Recommendation
It is recommended to upgrade Nokogiri to version 1.18.3 or later and avoid processing untrusted DTD and XSD files.
Original NVD description (English source)
Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.