CVE-2025-71406
Received Received - Intake

Use-After-Free in Nokogiri via libxslt

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulnerabilities: CVE-2025-24855 (use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt->node) and CVE-2024-55549 (use-after-free related to excluded result prefixes/namespaces). Processing crafted XSLT can trigger memory corruption. Nokogiri 1.18.4 upgrades the bundled libxslt to 1.1.43 to resolve these issues.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2025-71406
EUVD
EUVD-2025-210773

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
sparklemotion nokogiri to 1.18.4 (exc)
nokogiri nokogiri to 1.18.4 (exc)
libxslt libxslt to 1.1.43 (exc)
nokogiri nokogiri 1.18.4
libxslt libxslt 1.1.43

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Nokogiri before version 1.18.4 bundling a vulnerable libxslt library (prior to 1.1.43). It contains two use-after-free flaws: CVE-2025-24855 and CVE-2024-55549. These allow memory corruption when processing crafted XSLT, potentially leading to arbitrary code execution or denial of service.

Detection Guidance

Check the version of Nokogiri installed on your system. If it is below 1.18.4, the system is vulnerable. Run 'gem list nokogiri' to check the version. Also, verify the bundled libxslt version if using Nokogiri.

Impact Analysis

If exploited, attackers could execute arbitrary code or crash applications using Nokogiri with vulnerable libxslt. This may lead to data breaches, service disruption, or system compromise depending on the application context.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue involves memory corruption in libxslt used by Nokogiri, which could lead to arbitrary code execution or denial-of-service. Compliance impact would depend on how the vulnerability is exploited in a specific system.

Mitigation Strategies

Upgrade Nokogiri to version 1.18.4 or later. This version bundles libxslt 1.1.43, which resolves the use-after-free vulnerabilities. Use 'gem update nokogiri' to upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart