This CVE ID has been rejected as a duplicate.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Sparklemotion
  • Nokogiri

No data.

No data.

References
Link Providers
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-71346 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-71346 cve-icon
https://www.vulncheck.com/advisories/nokogiri-before-heap-buffer-under-read-via-xml-schema cve-icon
History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity. This CVE ID has been rejected as a duplicate.
Title Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema nokogiri: libxml2: Nokogiri: Heap buffer under-read in XML Schema validation
CPEs cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*
Vendors & Products Nokogiri
Nokogiri nokogiri
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 25 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Sparklemotion
Sparklemotion nokogiri
Vendors & Products Sparklemotion
Sparklemotion nokogiri

Tue, 25 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity.
Title Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema
First Time appeared Nokogiri
Nokogiri nokogiri
Weaknesses CWE-125
CPEs cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*
Vendors & Products Nokogiri
Nokogiri nokogiri
References
Metrics cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: REJECTED

Assigner: VulnCheck

Published: 2026-08-25T15:15:57.921Z

Updated: 2026-09-01T20:33:44.722Z

Reserved: 2026-06-20T12:48:06.735Z

Link: CVE-2025-71346

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-25T16:16:45.320

Modified: 2026-09-01T21:17:55.447

Link: CVE-2025-71346

cve-icon Redhat

Severity : Low

Publid Date: 2026-08-25T15:15:57Z

Links: CVE-2025-71346 - Bugzilla