CVE-2025-71407

[CVE catalog]

Nokogiri before 1.18.3, when using bundled libxml2, is affected by the libxml2 flaws CVE-2025-24928 and CVE-2024-56171. rubygem-nokogiri: Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free This CVE does not represent a flaw in Nokogiri, but is rather a duplicate assignment for different CVEs affecting libxml2 or libxslt. The rubygem-nokogiri packages as shipped in Red Hat products do not bundled libxml2 and libxslt, but rather use system packages of those libraries. This CVE is therefore not applicable to the rubygem-nokogiri packages provided by Red Hat. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Critical · CVSS 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jan 1, 2025, 12:00:00 AM UTC

Updated

Aug 25, 2026, 5:17:04 PM UTC

Source

[NVD] · [CVE record]

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "ruby-nokogiri",
      "distro": "debian",
      "ranges": [
        {
          "fixed": "0",
          "introduced": "0"
        }
      ],
      "release": "bookworm",
      "ecosystem": "deb",
      "fixed_version": "0"
    }
  ]
}