CVE-2024-58377
Received Received - Intake

Nokogiri libxml2 xmllint Tool Vulnerability

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2024-58377
EUVD
EUVD-2024-55731

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
sparklemotion nokogiri 1.16.5
gnome libxml2 2.12.6
sparklemotion nokogiri to 1.16.5 (exc)
gnome libxml2 to 2.12.7 (exc)
gnome libxml2 2.12.7
nokogiri nokogiri to 1.16.5 (exc)
libxml2 libxml2 to 2.12.6 (exc)
libxml2 libxml2 From 2.12.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nokogiri versions before 1.16.5 due to its bundled libxml2 version 2.12.6, which is impacted by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades libxml2 to 2.12.7 to resolve the issue. However, Nokogiri does not expose or provide the xmllint tool, so users are not affected.

Detection Guidance

Since Nokogiri does not expose the xmllint tool, detection is not necessary for Nokogiri users. However, if you use libxml2 directly, check the version with commands like 'xmllint --version' or 'dpkg -l libxml2' on Debian-based systems or 'rpm -qa libxml2' on RPM-based systems.

Impact Analysis

There is no impact on Nokogiri users because the vulnerable xmllint tool is not included or exposed in Nokogiri. The issue exists only in libxml2's xmllint tool, which Nokogiri does not provide.

Compliance Impact

This vulnerability does not affect compliance with standards like GDPR or HIPAA because Nokogiri does not expose or provide the xmllint tool where the issue occurs, and the maintainers confirm no impact on users.

Mitigation Strategies

Upgrade Nokogiri to version 1.16.5 or later, which bundles libxml2 2.12.7. If you use libxml2 directly, upgrade to version 2.12.7 or higher to address CVE-2024-34459.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58377. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart