Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity.

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

Uncontrolled resource consumption vulnerability in the XML catalog processing logic of the libxml2 library. The issue arises when handling chains of XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. During entity resolution, the parser redundantly traverses catalog chains, causing exponential growth in processing time as depth increases. This can be exploited by supplying crafted catalogs to cause excessive CPU consumption and degrade application availability, resulting in a denial-of-service condition.

This update includes the following RPMs:libxml2: libxml2-16-2.15.3-0.1.hum1 (aarch64, x8664) libxml2-2.15.3-0.1.hum1 (aarch64, x8664) libxml2-devel-2.15.3-0.1.hum1 (aarch64, x8664) libxml2-static-2.15.3-0.1.hum1 (aarch64, x8664) python3-libxml2-2.15.3-0.1.hum1 (aarch64, x8664) libxml2-2.15.3-0.1.hum1.src (src)

This update includes the following RPMs:libxml2: libxml2-16-2.15.2-0.3.hum1 (aarch64, x8664) libxml2-2.15.2-0.3.hum1 (aarch64, x8664) libxml2-devel-2.15.2-0.3.hum1 (aarch64, x8664) libxml2-static-2.15.2-0.3.hum1 (aarch64, x8664) python3-libxml2-2.15.2-0.3.hum1 (aarch64, x8664) libxml2-2.15.2-0.3.hum1.src (src)

Important: Release of OpenShift Serverless Logic 1.36.0 security update & enhancements