CVE-2025-71407: Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free

Q: Who is exposed to this issue?

Applications using Nokogiri versions earlier than 1.18.3 are exposed if they process attacker-controlled DTD content or validate XML using untrusted XSD files.

Q: What must an attacker be able to provide to exploit it?

An attacker needs to supply malicious DTD content with long QName prefixes, or an untrusted XML Schema used during validation. No privileges or user interaction are required according to the provided severity vector.

Q: Are all Nokogiri uses affected?

The described attack paths depend on DTD validation error reporting or validation against untrusted XML Schemas. The provided data does not establish exposure for applications that do not perform those operations on untrusted input.

Q: What is the immediate mitigation if upgrading is not possible?

Do not accept or process untrusted DTD content, and avoid validating documents against untrusted XSD files. These measures remove the attacker-controlled inputs identified as triggers.

Published Aug 25, 2026

Updated

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.

Affected Software

1 affected component

ruby/nokogiri<1.18.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nokogiri to a version that resolves this vulnerability.
Fixed in 1.18.3
Compensating control
Ensure applications do not load or validate against untrusted XML Schemas (XSD files) or malicious DTD content; only use trusted/controlled DTD/XSD inputs to prevent denial of service and potential code execution paths described for Nokogiri before 1.18.3.

Event History

Aug 25, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using Nokogiri versions earlier than 1.18.3 are exposed if they process attacker-controlled DTD content or validate XML using untrusted XSD files.

What must an attacker be able to provide to exploit it?

An attacker needs to supply malicious DTD content with long QName prefixes, or an untrusted XML Schema used during validation. No privileges or user interaction are required according to the provided severity vector.

Are all Nokogiri uses affected?

The described attack paths depend on DTD validation error reporting or validation against untrusted XML Schemas. The provided data does not establish exposure for applications that do not perform those operations on untrusted input.

What is the immediate mitigation if upgrading is not possible?

Do not accept or process untrusted DTD content, and avoid validating documents against untrusted XSD files. These measures remove the attacker-controlled inputs identified as triggers.

CVE-2025-71407: Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker be able to provide to exploit it?

Are all Nokogiri uses affected?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker be able to provide to exploit it?

Are all Nokogiri uses affected?

What is the immediate mitigation if upgrading is not possible?