Description
This CVE ID has been rejected as a duplicate.
Published: 2026-08-25
Score: 2.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity. This CVE ID has been rejected as a duplicate.
Title Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema nokogiri: libxml2: Nokogiri: Heap buffer under-read in XML Schema validation
CPEs cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*
Vendors & Products Nokogiri
Nokogiri nokogiri
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 25 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Sparklemotion
Sparklemotion nokogiri
Vendors & Products Sparklemotion
Sparklemotion nokogiri

Tue, 25 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity.
Title Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema
First Time appeared Nokogiri
Nokogiri nokogiri
Weaknesses CWE-125
CPEs cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*
Vendors & Products Nokogiri
Nokogiri nokogiri
References
Metrics cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Sparklemotion Nokogiri
cve-icon MITRE

Status: REJECTED

Assigner: VulnCheck

Published:

Updated: 2026-09-01T20:33:44.722Z

Reserved: 2026-06-20T12:48:06.735Z

Link: CVE-2025-71346

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-25T16:16:45.320

Modified: 2026-09-01T21:17:55.447

Link: CVE-2025-71346

cve-icon Redhat

Severity : Low

Publid Date: 2026-08-25T15:15:57Z

Links: CVE-2025-71346 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T17:30:07Z

Weaknesses