CVE-2025-71407: Nokogiri Buffer Overflow Vulnerability

CVE-2025-71407 Overview

CVE-2025-71407 affects Nokogiri versions before 1.18.3. The vulnerability originates in the bundled libxml2 library and consists of two distinct memory corruption flaws. The first is a stack buffer overflow triggered when libxml2 reports Document Type Definition (DTD) validation errors containing long QName prefixes. The second is a use-after-free condition that occurs during validation against untrusted XML Schema Definition (XSD) files. Attackers can supply malicious DTD content or crafted XSD files to trigger denial of service or potentially execute arbitrary code within processes that parse untrusted XML with Nokogiri.

Critical Impact
Applications parsing untrusted XML with Nokogiri before 1.18.3 face code execution and denial-of-service risk through crafted DTD or XSD input.

Affected Products

Nokogiri Ruby gem versions before 1.18.3
Applications embedding the bundled libxml2 shipped with vulnerable Nokogiri releases
Ruby web services performing DTD or XML Schema validation on untrusted XML

Discovery Timeline

2026-08-25 - CVE-2025-71407 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2025-71407

Vulnerability Analysis

CVE-2025-71407 combines two memory safety defects in the libxml2 code path used by Nokogiri. The stack buffer overflow occurs inside the DTD validation error reporting routine. When libxml2 formats an error message for a QName whose prefix exceeds the fixed-size on-stack buffer, the write crosses the buffer boundary and corrupts adjacent stack frames. This classifies as an out-of-bounds write [CWE-787].

The second defect is a use-after-free during XML Schema (XSD) validation. When Nokogiri validates a document against an untrusted schema, an object referenced during validation is freed while a dangling pointer remains in scope. Subsequent access to the freed memory produces undefined behavior that an attacker can shape through controlled schema content.

Both flaws are reachable through the network attack surface exposed by any service that accepts XML from remote clients and performs DTD or XSD validation using Nokogiri.

Root Cause

The stack overflow stems from unchecked string length assumptions when copying QName prefix data into an error message buffer during DTD validation. The use-after-free stems from incorrect lifetime management of schema-associated allocations during validation of attacker-supplied XSD content.

Attack Vector

An attacker submits XML that either references a malicious DTD with an oversized QName prefix or is validated against an attacker-controlled XSD. Neither path requires authentication or user interaction if the target service exposes an XML processing endpoint. Successful exploitation of the stack overflow can corrupt return addresses or saved registers, enabling control-flow hijack. Exploitation of the use-after-free can enable arbitrary read or write primitives depending on heap layout.

No public proof-of-concept exploit code is referenced in the advisory. See the GitHub Security Advisory and the VulnCheck Nokogiri Advisory for technical detail.

Detection Methods for CVE-2025-71407

Indicators of Compromise

Ruby application processes crashing with SIGSEGV or SIGABRT while parsing XML through Nokogiri
XML payloads containing DTD declarations with unusually long QName prefixes
Inbound XSD files from untrusted sources referenced by application validation routines
Unexpected child processes spawned by Ruby workers handling XML uploads

Detection Strategies

Inventory Ruby applications and identify installed Nokogiri versions using bundle list nokogiri or gem list nokogiri
Inspect XML ingestion endpoints for code paths that call Nokogiri::XML::Document#validate or use Nokogiri::XML::Schema
Alert on Ruby process crashes correlated with XML parsing activity in application logs
Review web application firewall logs for XML payloads carrying oversized attribute or element name prefixes

Monitoring Recommendations

Enable core dump collection for Ruby workers to capture crash signatures useful for triage
Track Nokogiri version drift across build pipelines and container images
Monitor egress connections from Ruby processes that ingest external XSD references

How to Mitigate CVE-2025-71407

Immediate Actions Required

Upgrade Nokogiri to version 1.18.3 or later across all Ruby applications and container images
Rebuild and redeploy any application bundling a vulnerable libxml2 through Nokogiri
Audit XML processing endpoints and disable DTD and external XSD loading where not required
Restrict schema validation to XSD files from trusted, version-controlled sources

Patch Information

Upgrade to Nokogiri 1.18.3 or later. The maintainers address both the stack buffer overflow and the use-after-free in this release. Refer to the GitHub Security Advisory GHSA-vvfq-8hwr-qm4m for release notes and fix commits.

Workarounds

Disable DTD loading by configuring parser options such as Nokogiri::XML::ParseOptions::NONET and avoiding DTDLOAD
Reject XML documents containing inline DTD subsets at the application boundary
Validate only against XSD files stored on the local filesystem under integrity control
Isolate XML parsing workloads in sandboxed processes or containers with restricted syscalls

bash

# Configuration example
bundle update nokogiri --conservative
bundle exec ruby -e 'require "nokogiri"; puts Nokogiri::VERSION'
# Expected output: 1.18.3 or later