7340 matches found
CVE-2025-71407
Nokogiri (Ruby gem for parsing HTML/XML) versions before 1.18.3 are affected by two vulnerabilities in its bundled libxml2 library: a stack buffer overflow when reporting DTD validation errors with long (~3 KB) QName prefixes, and a use-after-free during validation against untrusted XML Schemas. ...
EUVD-2025-210772
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...
CVE-2025-71346
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8), introducing a heap-based buffer under-read in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The flaw is triggered when validating against an untrusted XML Schema, or when validating untrusted documents aga...
EUVD-2024-55732
Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude...
CVE-2024-58378
...
CVE-2024-58378
Removed by vendor...
CVE-2025-71346
Removed by vendor...
CVE-2024-58378
CVE-2024-58378 was rejected by NVD as a duplicate, but connected advisories provide concrete details. Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby using packaged libxml2 ) is vulnerable to a use-after-free in the xmlTextReader module (xmlValidatePopElement), underlying Nokogiri::XML::Re...
CVE-2024-58378 Nokogiri before 1.16.2 Use-After-Free via xmlTextReader
Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude...
CVE-2025-71346 Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...
CVE-2024-58377
Removed by vendor...
EUVD-2024-55731
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the...
CVE-2024-58377
...
CVE-2024-58377 Nokogiri before 1.16.5 libxml2 Dependency Update
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the...
CVE-2024-58377
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6 , which is affected by CVE-2024-34459 in the xmllint tool. The underlying issue is an uncontrolled search path element : an attacker can potentially influence the search path used for external libraries by manipulating environment variables or...