CVE-2025-71346: Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema
Rejected reason: This CVE ID has been rejected as a duplicate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nokogirito a version that resolves this vulnerability.Fixed in 1.18.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-32415
Event History
Frequently Asked Questions
Which XML validation workflows are affected?
The issue can be triggered by validating an untrusted XML Schema. It can also be triggered when untrusted documents are validated against trusted schemas that use xsd:keyref together with recursively defined types having additional identity constraints.
What must an attacker be able to provide to trigger the issue?
An attacker needs to influence an XML Schema used for validation, or provide an untrusted XML document to a vulnerable validation workflow using a trusted schema with the specified xsd:keyref and recursive-type conditions.
Which versions should be remediated?
Nokogiri versions before 1.18.8 package a vulnerable libxml2 version. The affected underlying libxml2 versions are before 2.13.8.