Description

Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing a crafted XML document can lead to an xmlValidatePopElement use-after-free. Nokogiri 1.15.6 and 1.16.2 resolve this by upgrading the packaged libxml2 to 2.11.7 and 2.12.5 respectively. JRuby and installations using system libxml2 are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T16:16:45.153Z",
  "pubdate": "2026-08-25T16:16:45.153Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in Nokogiri versions prior to 1.15.6 and 1.16.2 when using the packaged libxml2 library. The vulnerability, tracked as CVE-2024-25062, resides within the libxml2 xmlTextReader module. This memory corruption flaw allows a remote attacker to trigger a use-after-free condition by supplying a specially crafted XML document to an application using Nokogiri::XML::Reader with DTD validation and XInclude expansion enabled. Successful exploitation can lead to arbitrary code execution, denial of service (application crashes), or potential memory disclosure. The vulnerability is specific to CRuby installations utilizing the bundled libxml2; JRuby users and environments linking against system-provided libxml2 libraries are not affected. Given the nature of use-after-free vulnerabilities, the risk is high, as it grants attackers the ability to manipulate memory state during the parsing of untrusted XML input, potentially bypassing security controls or crashing the underlying Ruby process.",
  "technicalDetails": "The vulnerability is rooted in the xmlTextReader module of the libxml2 library, specifically triggered during the validation process involving DTDs (Document Type Definitions) and XInclude expansion. The memory corruption occurs in the xmlValidatePopElement function, which fails to correctly manage the lifecycle of elements when processed under specific, concurrent parsing configurations.\nWhen Nokogiri::XML::Reader is initialized with DTD validation and XInclude expansion, the parser maintains an internal state machine to track element stacks and validate structural integrity. A use-after-free condition is triggered when an attacker provides a maliciously crafted XML structure that forces the parser to free memory associated with an element node, yet subsequently attempts to access that same memory reference during the xmlValidatePopElement transition. Because the memory has already been deallocated, the pointer becomes dangling.\nThe attack flow proceeds as follows: 1) An attacker submits an XML payload designed to trigger complex entity or XInclude resolution. 2) The parser invokes the DTD validation logic, which manages the element stack. 3) The malicious input causes a sequence of operations that result in the invalidation of an element pointer while the validator continues to reference it. 4) The library executes xmlValidatePopElement on the now-freed memory. 5) By controlling the content of the heap at the time of the free, an attacker may influence the subsequent dereference, potentially redirecting execution flow or causing a fatal segmentation fault.\nThis vulnerability is restricted to environments where Nokogiri is compiled with the bundled libxml2. It impacts Nokogiri versions < 1.15.6 and 1.16.0-1.16.1. The impact is significant as it affects the core XML parsing pipeline, which is often used to process user-supplied configuration files, web requests, or document uploads. Exploitation does not require authentication, provided the target application is configured to parse user-supplied input using the affected XML Reader interface with the specified features enabled. The post-exploitation impact includes the ability to cause process instability and the possibility of arbitrary memory manipulation, which, depending on the heap layout and protection mechanisms, could lead to remote code execution."
}