CVE-2025-71346: Nokogiri libxml2 Buffer Overflow Vulnerability

CVE-2025-71346 Overview

CVE-2025-71346 affects Nokogiri versions before 1.18.8, which package a vulnerable version of libxml2 (before 2.13.8). The bundled library contains a heap-based buffer under-read tracked as CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function within xmlschemas.c. Applications that validate untrusted XML against XML Schema (XSD), or that validate untrusted documents against trusted schemas using xsd:keyref with recursively defined types and additional identity constraints, can trigger the flaw. The weakness is categorized under CWE-125 (Out-of-Bounds Read). Upstream maintainers and MITRE rate the underlying issue as low severity, though the National Vulnerability Database assigns it a CVSS 4.0 score of 8.7.

Critical Impact
An attacker who supplies a crafted XML Schema or document to a Nokogiri-based validator can trigger an out-of-bounds heap read, resulting in process instability or denial of service.

Affected Products

Nokogiri Ruby gem versions before 1.18.8
Bundled libxml2 versions before 2.13.8
Ruby applications using Nokogiri's XSD schema validation APIs

Discovery Timeline

2026-08-25 - CVE-2025-71346 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2025-71346

Vulnerability Analysis

Nokogiri statically links libxml2 and inherits any memory-safety defects present in the bundled version. The upstream defect, CVE-2025-32415, is a heap-based buffer under-read inside xmlSchemaIDCFillNodeTables. The function populates identity-constraint node tables during XSD validation. When the schema uses xsd:keyref alongside recursively defined types that carry additional identity constraints, the routine indexes memory before the intended buffer boundary. The read leaks adjacent heap contents into internal state or crashes the process, depending on allocator behavior.

Root Cause

The root cause is improper boundary handling in xmlSchemaIDCFillNodeTables when it walks identity-constraint tables for recursive schema types. The function does not correctly validate the lower index used to access previously populated table entries, producing an out-of-bounds read below the allocated buffer. Nokogiri releases prior to 1.18.8 ship the pre-fix libxml2 code path and expose the same defect to any caller that invokes Nokogiri::XML::Schema validation.

Attack Vector

Exploitation requires the target application to validate attacker-influenced content. Two scenarios apply: validating an untrusted XSD supplied by an attacker, or validating untrusted XML documents against a trusted schema that uses xsd:keyref with recursive types and additional identity constraints. The attack is remote and requires no authentication or user interaction when the vulnerable code path is reachable over the network, for example through an API endpoint that accepts XML uploads. The primary impact is availability loss through process termination; information disclosure via leaked heap bytes is theoretically possible but not demonstrated in public reporting.

No public proof-of-concept exploit is currently available. See the GitHub Security Advisory GHSA-5w6v-399v-w3cc and the VulnCheck Nokogiri Advisory for authoritative technical detail.

Detection Methods for CVE-2025-71346

Indicators of Compromise

Unexpected crashes or segmentation faults in Ruby worker processes that perform XML validation using Nokogiri.
Application logs showing exceptions or aborts originating from Nokogiri::XML::Schema#validate or #valid? calls.
Inbound XML or XSD payloads containing xsd:keyref constructs paired with recursive type definitions and multiple identity constraints.

Detection Strategies

Inventory installed gems and flag any Nokogiri version below 1.18.8 using bundle list nokogiri or gem list nokogiri across build systems and running hosts.
Enable ASan or Valgrind in pre-production test suites to catch out-of-bounds reads triggered by fuzzed XSD inputs.
Instrument WAF and API gateway rules to log XML payloads that reference xsd:keyref and unusually deep or self-referential schema types.

Monitoring Recommendations

Monitor endpoints that accept XML uploads for elevated 5xx rates and worker restarts correlated with specific client sources.
Alert on repeated OS-level crash signals (SIGSEGV, SIGABRT) from Ruby application processes.
Track dependency drift by ingesting SBOM data into a security data lake and alerting when vulnerable Nokogiri versions reappear in new builds.

How to Mitigate CVE-2025-71346

Immediate Actions Required

Upgrade Nokogiri to version 1.18.8 or later across all Ruby applications and CI/CD pipelines.
Rebuild and redeploy container images and artifacts that bundle Nokogiri to ensure the patched native extension is loaded.
Audit application endpoints that accept XML or XSD input from untrusted sources and restrict them until patched.

Patch Information

Nokogiri 1.18.8 bundles libxml22.13.8, which contains the upstream fix for CVE-2025-32415 in xmlSchemaIDCFillNodeTables. Applications that use system libxml2 should update the system package to 2.13.8 or later and rebuild Nokogiri against the patched library. Refer to the GitHub Security Advisory GHSA-5w6v-399v-w3cc for release notes and upgrade guidance.

Workarounds

Reject XSD schemas supplied by untrusted parties and validate only against a curated, trusted schema set.
Remove or refactor trusted schemas that combine xsd:keyref with recursively defined types and additional identity constraints where feasible.
Sandbox XML validation workers with strict resource limits and automatic restart policies to contain crash impact until patching completes.

bash

# Configuration example
bundle update nokogiri --conservative
bundle exec ruby -rnokogiri -e 'puts Nokogiri::VERSION, Nokogiri::LIBXML_LOADED_VERSION'
# Expect Nokogiri >= 1.18.8 and libxml2 >= 2.13.8