Nokogiri CVE-2025-71346

Exploitation requires that the application invoke Nokogiri's XML Schema validation in one of two specific configurations: (1) the application validates any XML document against an attacker-controlled or attacker-influenced XSD schema file - meaning the attacker can supply or tamper with the .xsd used for validation; or (2) the application validates attacker-supplied XML documents against a trusted, operator-controlled schema that already contains xsd:keyref in combination with recursively defined complex types that carry additional identity constraints - a non-default, purpose-specific schema design. Applications that perform no XSD schema validation, or that validate only against fully trusted schemas not using this xsd:keyref-plus-recursive-type pattern, are not exploitable. The CVSS 4.0 vector (PR:N) and MITRE's CVSS 3.1 vector (AV:L/AC:H) are in direct conflict - authentication requirements and attack vector cannot be stated with confidence from the available data. The specific schema feature combination required (xsd:keyref plus recursive types with identity constraints) constitutes a meaningful exploitation barrier not captured by the NVD score.

The available risk signals for this vulnerability are materially conflicting and require explicit reconciliation. The NVD-assigned CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) implies a network-reachable, low-complexity, unauthenticated denial-of-service - a framing that would suggest urgency across virtually any deployment. However, MITRE's independent CVSS 3.1 assessment is 2.9 LOW (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), which characterizes the attack as locally constrained and high-complexity - a drastically different posture. The upstream libxml2 maintainer explicitly supports the low-severity reading, noting that exploitation requires the narrow combination of xsd:keyref, recursively defined types, and additional identity constraints. No CISA KEV listing exists, no EPSS data is available in the supplied intelligence, and no public exploit code has been identified. The realistic threat surface is narrow: only applications that perform XSD schema validation against attacker-influenced schemas or attacker-controlled XML documents meeting the specific structural requirements are exposed. The CVSS 4.0 score appears to reflect a worst-case library-level framing rather than the constrained real-world trigger conditions described by the maintainer. Defenders should treat this as a routine patch-cycle update rather than an emergency response item, while prioritizing upgrade for any pipeline that validates untrusted XSD schemas.

An attacker submits a crafted XSD schema or a specially structured XML document to a Ruby application that uses Nokogiri's XML Schema validation - for example, an API endpoint that accepts XML payloads and validates them. If the schema in use includes xsd:keyref references targeting recursively defined complex types with additional identity constraints, the crafted input drives libxml2's xmlSchemaIDCFillNodeTables into a heap-based buffer under-read, potentially crashing the application worker process and causing denial of service. No public exploit code is known at time of analysis, and the high attack complexity (requiring specific schema structural conditions) substantially limits opportunistic exploitation.