CVE-2024-58378: Nokogiri libxml2 Use-After-Free Vulnerability

CVE-2024-58378 Overview

CVE-2024-58378 affects Nokogiri, the widely used Ruby XML and HTML parsing library. The flaw exists in versions before 1.15.6 and 1.16.x before 1.16.2 when built with CRuby using the packaged libxml2. Nokogiri inherits a use-after-free vulnerability from libxml2 (tracked as CVE-2024-25062) in the xmlTextReader module. This module underlies the Nokogiri::XML::Reader interface. Processing a crafted XML document with Document Type Definition (DTD) validation and XInclude expansion enabled triggers an xmlValidatePopElement use-after-free. JRuby builds and installations linked against system libxml2 are not affected.

Critical Impact
Attackers can trigger memory corruption in Ruby applications that parse untrusted XML with DTD validation and XInclude expansion enabled, potentially leading to code execution or process crash.

Affected Products

Nokogiri versions prior to 1.15.6 (CRuby, packaged libxml2)
Nokogiri 1.16.x versions prior to 1.16.2 (CRuby, packaged libxml2)
Ruby applications using Nokogiri::XML::Reader with DTD validation and XInclude enabled

Discovery Timeline

2026-08-25 - CVE-2024-58378 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2024-58378

Vulnerability Analysis

The vulnerability is a use-after-free classified under [CWE-416]. It resides in the xmlTextReader module of libxml2, which Nokogiri packages and links against on CRuby builds. When application code parses XML through the streaming Reader interface with both DTD validation and XInclude expansion enabled, libxml2 calls xmlValidatePopElement against memory that has already been freed during XInclude substitution. An attacker who supplies a crafted XML document to a vulnerable parser can influence freed memory and corrupt process state.

The network attack vector applies wherever Ruby services accept XML input from remote sources. Web applications, SOAP endpoints, RSS/Atom feed processors, and configuration importers all commonly feed data into Nokogiri::XML::Reader. Successful exploitation impacts confidentiality, integrity, and availability of the host process.

Root Cause

The defect lives in libxml2 upstream, not in Ruby code written by Nokogiri maintainers. xmlValidatePopElement operates on element context structures that XInclude processing releases prematurely. The Reader interface streams nodes and revisits validation state after inclusion, which reaches the freed structure. Nokogiri inherits the flaw because it ships a bundled libxml2 for CRuby installations.

Attack Vector

An attacker delivers a crafted XML document to a Ruby application that instantiates Nokogiri::XML::Reader with DTD validation and XInclude expansion enabled. The Reader traverses the document, XInclude substitution frees an element structure, and subsequent validation on the popped element accesses freed memory. Consult the GitHub Security Advisory GHSA-xc9x-jj77-9p9j and the VulnCheck advisory on Nokogiri for advisory-level detail. No public proof-of-concept is currently listed for CVE-2024-58378.

Detection Methods for CVE-2024-58378

Indicators of Compromise

Ruby application processes crashing with SIGSEGV or SIGABRT while parsing XML input through Nokogiri::XML::Reader.
Anomalous heap corruption traces or AddressSanitizer reports referencing xmlValidatePopElement in application logs.
Inbound XML payloads containing XInclude directives (xi:include) combined with DTD declarations from untrusted sources.

Detection Strategies

Inventory installed Nokogiri versions across Ruby services using bundle list nokogiri or gem list nokogiri and flag any CRuby install below 1.15.6 or 1.16.2.
Static-scan application code for Nokogiri::XML::Reader usage combined with the DTDVALID and XINCLUDE parse options.
Ingest software composition analysis (SCA) findings into a centralized data lake to correlate vulnerable dependency versions with exposed services.

Monitoring Recommendations

Monitor Ruby application crash rates and generate alerts when XML parsing paths produce repeated segmentation faults.
Track WAF or API gateway logs for XML payloads containing XInclude directives directed at endpoints that consume XML.
Continuously verify patch state for Nokogiri across build pipelines and container images.

How to Mitigate CVE-2024-58378

Immediate Actions Required

Upgrade Nokogiri to 1.15.6, 1.16.2, or later on all CRuby-based deployments and rebuild container images.
Audit application code for Nokogiri::XML::Reader calls that enable DTD validation and XInclude, and disable those options where they are not required.
Restrict or reject inbound XML from untrusted sources at the perimeter until patched versions are deployed.

Patch Information

The Nokogiri maintainers resolved the issue by upgrading the packaged libxml2 to 2.11.7 in Nokogiri 1.15.6 and to 2.12.5 in Nokogiri 1.16.2. Review the upstream fix commit and the GitHub Security Advisory GHSA-xc9x-jj77-9p9j for release-level details. JRuby installations and CRuby installations built against system libxml2 (with a patched system library) are not affected.

Workarounds

Disable XInclude expansion on Reader instances that process untrusted XML by omitting the XINCLUDE parse option.
Disable DTD validation (DTDVALID) on Reader instances that do not require schema enforcement.
Route XML parsing to JRuby or to a CRuby build linked against a patched system libxml2 (2.11.7 or 2.12.5 and later) while upgrades are in progress.

bash

# Upgrade Nokogiri to a patched release
bundle update nokogiri --conservative
gem list nokogiri

# Verify the packaged libxml2 version reported by Nokogiri
ruby -rnokogiri -e 'puts Nokogiri::VERSION_INFO.inspect'