Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
## Summary Nokogiri v1.18.3 upgrades its dependency libxml2 to [v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6). libxml2 v2.13.6 addresses: - CVE-2025-24928 - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847 - CVE-2024-56171 - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828 ## Impact ### CVE-2025-24928 Stack-buffer overflow is possible when reporting DTD validation errors if the input contains a long (~3kb) QName prefix. ### CVE-2024-56171 Use-after-free is possible during validation against untrusted XML Schemas (.xsd) and, potentially, validation of untrusted documents against trusted Schemas if they make use of `xsd:keyref` in combination with recursively defined types that have additional identity constraints.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | nokogiri (RubyGems) | before 1.18.3 | 1.18.3 | Patch available | GHSA-vvfq-8hwr-qm4m |
- nokogiri (RubyGems) Vendor— Affected before 1.18.3 Fixed in 1.18.3 Patch available GHSA-vvfq-8hwr-qm4m
Remediation
- Fix · GHSA-vvfq-8hwr-qm4m nokogiri (RubyGems) Fixed in 1.18.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-vvfq-8hwr-qm4m
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences