Which versions of Nokogiri are affected by CVE-2025-71407?

Ruby applications using Nokogiri are exposed to critical memory-corruption vulnerabilities enabling denial of service and potential remote code execution through XML processing.. A patch is available.

How to fix or mitigate CVE-2025-71407?

Within 24 hours: Inventory all Ruby/Rails applications using Nokogiri; disable DTD and XSD validation capabilities unless business-critical, or implement strict allowlisting of trusted schemas. Within 7 days: Deploy input validation to reject malformed XML elements and enforce size limits; monitor logs for validation failures and memory errors; isolate XML processing in sandboxed environments. Within 30 days: Prepare for immediate Nokogiri patch deployment upon vendor release; if patch is not forthcoming, migrate to alternative XML libraries with lower attack surface.

Nokogiri CVE-2025-71407

Q: What is the CVSS score of CVE-2025-71407?

CVE-2025-71407 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210774 CRITICAL

Out-of-bounds Write (CWE-787)

2026-08-25 VulnCheck

GHSA-hfqg-gq7v-xwpg

Memory Corruption Buffer Overflow Denial Of Service RCE Nokogiri

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Remote untrusted input with low complexity and no auth (AV:N/AC:L/PR:N); reliable impact is DoS (A:H) with only potential, unconfirmed code execution, so C:L/I:L rather than H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 25, 2026 - 17:17 EUVD

Source Code Evidence Fetched

Aug 25, 2026 - 16:02 vuln.today

Analysis Generated

Aug 25, 2026 - 16:02 vuln.today

CVE Published

Aug 25, 2026 - 15:15 cve.org

CRITICAL 9.3

DescriptionCVE.org

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.

AnalysisAI

Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bundles a vulnerable libxml2. The flaw combines a stack buffer overflow when libxml2 reports DTD validation errors involving long (~3kb) QName prefixes (CVE-2025-24928) and a use-after-free during validation against untrusted XML Schemas using xsd:keyref with recursively defined types (CVE-2024-56171). Any Ruby/Rails application that validates attacker-supplied DTD or XSD content is exposed; no public exploit identified at time of analysis, and the issue is not in CISA KEV.

Technical ContextAI

Nokogiri is the de-facto XML/HTML parsing library for Ruby, wrapping the native libxml2 C library; it ships its own precompiled copy of libxml2, so the gem version - not the system libxml2 - determines exposure. The root cause is CWE-787 (out-of-bounds write): in libxml2's DTD validation error-reporting code an overly long QName prefix overflows a fixed stack buffer, while a separate defect frees and then reuses memory (use-after-free) while processing identity-constraint (xsd:keyref) relationships in recursively defined schema types. Nokogiri 1.18.3 resolves both by upgrading the vendored libxml2 to v2.13.6, which carries the upstream fixes for CVE-2025-24928 and CVE-2024-56171.

RemediationAI

Vendor-released patch: upgrade Nokogiri to 1.18.3 or later, which bundles libxml2 2.13.6 and closes both CVE-2025-24928 and CVE-2024-56171; update the gem via your Gemfile/bundler and redeploy (see GHSA-vvfq-8hwr-qm4m). If immediate upgrade is not possible, reduce exposure by not parsing or validating untrusted DTDs and XSDs: disable DTD loading/validation on untrusted input (e.g., avoid Nokogiri parse options that enable DTD validation such as DTDVALID/DTDLOAD) and refuse to validate documents against attacker-supplied schema files, accepting only trusted, locally controlled schemas - the trade-off is loss of validation functionality for those inputs. Where feasible, isolate XML parsing in a sandboxed or resource-limited process so a crash degrades gracefully. If your build uses the system libxml2, ensure it is upgraded to 2.13.6+.