55532 matches found
CVE-2025-71407 Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free
Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DT...
CVE-2025-71407
...
EUVD-2025-210772
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...
CVE-2025-71346
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8), introducing a heap-based buffer under-read in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The flaw is triggered when validating against an untrusted XML Schema, or when validating untrusted documents aga...
CVE-2025-71346
Removed by vendor...
CVE-2024-58378
Removed by vendor...
CVE-2025-71346 Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...
CVE-2023-54354
CVE-2023-54354 has been rejected as a duplicate , but its technical details remain relevant. Nokogiri before 1.14.3 (CRuby implementation only, using the packaged libxml2 v2.10.3 ) is vulnerable to NULL pointer dereferences in XML Schema processing (specifically in xmlSchemaFixupComplexType and x...
CVE-2022-51000 Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt
Nokogiri before 1.13.2 CRuby, when using packaged libraries ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via...
EUVD-2023-60605
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
CVE-2023-54354
Removed by vendor...
CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
CVE-2022-50999
CVE-2022-50999 has been rejected as a duplicate of CVE-2022-29824 . The underlying flaw is an integer overflow in the buffer handling functions (xmlBuf* in buf.c, xmlBuffer* in tree.c) of the packaged libxml2 shipped with Nokogiri (Ruby gem) versions before 1.13.5 . By submitting a crafted multi-...
EUVD-2022-56023
Nokogiri before 1.13.9 CRuby implementation using packaged libraries bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 data corruption / double-free from an entity reference cycle when entity content is allocated from a dict and CVE-2022-40303 integer overflows when parsing with...