GitHub Advisoryadvisory · RubyGems

GHSA-vvfq-8hwr-qm4m Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

LOW Published 2025-02-18 Modified 2025-03-10 Official page ↗
Ecosystem
RubyGems
Packages
nokogiri
Severity
Low
Weaknesses
CWE-121, CWE-1395, CWE-416
Reviewed
2025-02-18

Affected packages

• RubyGems nokogiri: < 1.18.3 → fixed in 1.18.3

Description

Summary Nokogiri v1.18.3 upgrades its dependency libxml2 to v2.13.6. libxml2 v2.13.6 addresses: • CVE-2025-24928 • described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847 • CVE-2024-56171 • described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828 Impact CVE-2025-24928 Stack-buffer overflow is possible when reporting DTD validation errors if the input contains a long (~3kb) QName prefix. CVE-2024-56171 Use-after-free is possible during validation against untrusted XML Schemas (.xsd) and, potentially, validation of untrusted documents against trusted Schemas if they make use of `xsd:keyref` in combination with recursively defined types that have additional identity constraints.

Related

Weakness · CWE (3)

  • CWE-121 Stack-based Buffer Overflow weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-416 Use After Free weakness

References