Description

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T16:16:45.633Z",
  "pubdate": "2026-08-25T16:16:45.633Z",
  "executiveSummary": "Nokogiri versions prior to 1.18.3 are susceptible to two critical memory corruption vulnerabilities stemming from the underlying libxml2 library. These vulnerabilities include a stack-based buffer overflow triggered during DTD validation error reporting and a use-after-free condition during XML Schema (XSD) validation.\nThe stack buffer overflow occurs when processing exceptionally long QName prefixes within DTDs, while the use-after-free occurs during the validation of untrusted XSD documents. Successful exploitation allows remote attackers to trigger memory corruption, potentially leading to application crashes (Denial of Service) or arbitrary code execution.\nThese vulnerabilities pose a high security risk, as they can be triggered by providing malicious XML or XSD inputs to the affected Nokogiri parser. The impact is significant in environments where user-supplied XML content is processed without strict sanitization. No specific authentication is required to initiate an attack, provided the attacker can submit crafted input to the application's parsing logic. Organizations utilizing affected versions of Nokogiri are advised to prioritize upgrading to version 1.18.3 or later to mitigate these security exposures.",
  "technicalDetails": "The vulnerabilities reside within the libxml2 library integrated into Nokogiri, specifically affecting how it handles structural validation of XML and Schema definitions. The first vulnerability involves a stack-based buffer overflow during the reporting of DTD validation errors. When the parser encounters malformed DTD content featuring an excessively long QName prefix, the error handling logic fails to perform adequate bounds checking when constructing the error message on the stack. This overflow allows for the corruption of stack memory, which, depending on the memory layout and compiler protections, can be leveraged to redirect execution flow.\nThe second vulnerability is a use-after-free (UAF) condition during the validation of XML Schemas. This defect occurs when the parser incorrectly manages the lifecycle of memory objects associated with validation structures. When an untrusted XSD is processed, the libxml2 validation engine may free memory associated with specific schema nodes prematurely while maintaining dangling pointers to those addresses. Subsequent access to these pointers during the validation process triggers a UAF condition. If an attacker can control the heap layout—often referred to as heap grooming—they may replace the freed memory with malicious data, subsequently influencing program execution when the dangling pointer is dereferenced.\nThe attack flow for both vulnerabilities requires the victim application to pass user-provided input directly to the Nokogiri XML or XSD parsing functions. For the buffer overflow, an attacker submits an XML document containing a crafted DTD with an oversized QName. As libxml2 attempts to validate the DTD and subsequently generate an error message, it triggers the stack overflow. For the UAF vulnerability, the attacker submits a specifically structured, malicious XSD file. The libxml2 validation engine processes this file, triggers the premature deallocation of critical structures, and crashes or executes arbitrary code when the engine attempts to access those structures later in the validation lifecycle.\nThese flaws are particularly dangerous because they do not require prior authentication or elevated privileges. Any application interface that accepts XML input for parsing or schema validation acts as a vector. Post-exploitation, an attacker can achieve arbitrary code execution under the security context of the application process, potentially leading to unauthorized data access, complete system compromise, or persistent denial of service."
}