EUVD-2025-18911Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack, low privileges, no user interaction, only availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of the patch is ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.
AnalysisAI
Heap-based buffer overflow in Nokogiri's gumbo HTML5 parser allows local attackers to cause a denial of service via crafted HTML with long duplicate attributes. The vulnerability exists in the hashmap implementation within gumbo-parser/src/hashmap.c, affecting versions 1.18.0 through 1.18.7. A public exploit exists, but the maintainer states the vulnerable code was never in an official release, and the real existence is doubted. EPSS score is low (0.02%), and no active exploitation has been confirmed.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-119) in the hashmap_set_with_hash function of the gumbo HTML5 parser library, which Nokogiri uses for parsing HTML5 documents. The CPE data indicates affected versions include nokogiri 1.18.0 to 1.18.7. The root cause is improper handling of string pointers in the string_set implementation, where a pointer to a pointer was needed instead of a direct pointer, leading to memory corruption when processing long duplicate attributes.
RemediationAI
Apply the vendor-released patch by updating Nokogiri to a version that includes commit ada4708e5a67114402cd3feb70a4e1d1d7cf773a. As of analysis, no official patched release has been announced; users should monitor the Nokogiri repository for a new release. Workaround: avoid parsing untrusted HTML5 content with affected versions, or restrict local access to the application using Nokogiri. The patch fixes the pointer handling in string_set.c.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| bionic | not-affected | code not present |
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| oracular | not-affected | code not present |
| plucky | not-affected | code not present |
| trusty | not-affected | code not present |
| upstream | not-affected | code not present |
| xenial | not-affected | code not present |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 1.11.1+dfsg-2 | - |
| bullseye (security) | fixed | 1.11.1+dfsg-2+deb11u1 | - |
| bookworm | fixed | 1.13.10+dfsg-2 | - |
| trixie | fixed | 1.18.2+dfsg-1 | - |
| forky | fixed | 1.18.10+dfsg-3 | - |
| sid | fixed | 1.19.1+dfsg-1 | - |
| (unstable) | not-affected | - | - |
Share
External POC / Exploit Code
Leaving vuln.today