CVE-2025-71346: Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.18.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-32415 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.13.8
Event History
Frequently Asked Questions
Which XML validation workflows are affected?
The issue can be triggered by validating an untrusted XML Schema. It can also be triggered when untrusted documents are validated against trusted schemas that use xsd:keyref together with recursively defined types having additional identity constraints.
What must an attacker be able to provide to trigger the issue?
An attacker needs to influence an XML Schema used for validation, or provide an untrusted XML document to a vulnerable validation workflow using a trusted schema with the specified xsd:keyref and recursive-type conditions.
Which versions should be remediated?
Nokogiri versions before 1.18.8 package a vulnerable libxml2 version. The affected underlying libxml2 versions are before 2.13.8.