libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted D

The core impact of CVE-2025-24928 lies in the potential for a stack-buffer overflow. An attacker can exploit this by providing specially crafted XML input containing a long QName prefix (approximately 3KB). This input triggers a validation error within libxml2, leading to the overflow. While a full remote code execution (RCE) is not immediately apparent, a crash can disrupt service and potentially lead to denial-of-service (DoS) conditions. The severity is classified as LOW, suggesting the exploitability is somewhat limited, but the potential for application instability remains a concern. Successful exploitation could also reveal information about the system's memory layout, potentially aiding further attacks.

Applications built with Ruby that rely on Nokogiri for XML or HTML parsing are at risk. This includes web applications, data processing pipelines, and any system that consumes XML from untrusted sources. Specifically, systems using older versions of Nokogiri in production environments are particularly vulnerable.

• ruby / gem: Check Nokogiri version using gem list nokogiri. If the version is ≤1.9.1, the system is vulnerable.

gem list nokogiri

• ruby / application: Inspect application logs for errors related to XML parsing or libxml2. Look for stack traces indicating memory corruption. • generic web: If Nokogiri is used to process user-supplied XML, monitor for unusually large XML requests. Implement rate limiting to prevent excessive requests.

1. 2025-02-18Disclosure

   disclosure

1. 予約済み2025-01-28
2. 公開日2025-02-18
3. 更新日2026-02-26
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-24928 is to upgrade Nokogiri to version 1.18.3 or later. This version incorporates the patched libxml2 library, resolving the underlying vulnerability. If an immediate upgrade is not feasible due to compatibility issues, consider implementing input validation to restrict the length of QName prefixes in XML documents processed by Nokogiri. While not a complete solution, this can reduce the attack surface. Web application firewalls (WAFs) configured to detect and block excessively long XML elements could also provide a layer of defense. After upgrading, confirm the fix by attempting to parse a large XML document with a long QName prefix; the application should not crash.