CVE-2024-58378
Received Received - Intake

Use-After-Free in Nokogiri with libxml2

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing a crafted XML document can lead to an xmlValidatePopElement use-after-free. Nokogiri 1.15.6 and 1.16.2 resolve this by upgrading the packaged libxml2 to 2.11.7 and 2.12.5 respectively. JRuby and installations using system libxml2 are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2024-58378
EUVD
EUVD-2024-55732

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
sparklemotion nokogiri From 1.15.6 (exc) to 1.16.2 (exc)
sparklemotion nokogiri From 1.16.2 (inc)
sparklemotion nokogiri From 1.15.0 (inc) to 1.15.6 (exc)
nokogiri nokogiri From 1.16.0 (inc) to 1.16.2 (exc)
libxml2 libxml2 2.11.7
libxml2 libxml2 2.12.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in Nokogiri's packaged libxml2 dependency. It affects the xmlTextReader module when processing crafted XML documents with DTD validation and XInclude expansion enabled. This can lead to memory corruption, potentially allowing arbitrary code execution.

Detection Guidance

To detect this vulnerability, check the installed Nokogiri and libxml2 versions. For Nokogiri, run gem list nokogiri or bundle show nokogiri. For libxml2, check the version via xml2-config --version or inspect the packaged library in Nokogiri's installation directory. Affected versions are Nokogiri >= 1.16.0, < 1.16.2 and >= 1.15.0, < 1.15.6.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code, crash applications, or gain unauthorized access to data. It specifically impacts CRuby users of Nokogiri versions >= 1.16.0, < 1.16.2 and >= 1.15.0, < 1.15.6 using packaged libxml2.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free flaw in libxml2 affecting XML document processing in Nokogiri. Compliance impacts would depend on how the vulnerability is exploited in a specific system, not the vulnerability itself.

Mitigation Strategies

Upgrade Nokogiri to version 1.15.6 or 1.16.2 or later. If using CRuby with packaged libxml2, ensure the upgrade includes the patched libxml2 (2.11.7 or 2.12.5). Alternatively, compile Nokogiri against a patched external libxml2 library. Avoid using DTD validation and XInclude expansion with XML Reader if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart