A high-severity use-after-free flaw in the libxml2 library packaged with Nokogiri lets a crafted XML document trigger memory corruption when parsed through Nokogiri::XML::Reader with DTD validation and XInclude expansion enabled.
What Is It
CVE-2024-58378 is a use-after-free (CWE-416) affecting Nokogiri, the widely used Ruby XML/HTML parsing gem. The bug does not originate in Nokogiri's own code; it is inherited from the vendored copy of libxml2, where it is tracked as CVE-2024-25062. The defect lives in libxml2's xmlTextReader module, the component underlying Nokogiri::XML::Reader. When the XML Reader interface is used with both DTD validation and XInclude expansion turned on, processing an attacker-supplied XML document can trigger a use-after-free in xmlValidatePopElement.
Why It Matters
The upstream libxml2 issue carries a CVSS v3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vector is network-reachable, low attack complexity, no privileges required, and no user interaction, but the assessed impact is confined to availability, with no direct confidentiality or integrity loss. In practice the realistic outcome is a crash or denial of service in the parsing process, not attacker-controlled data disclosure or code execution. Any Ruby service that accepts untrusted XML and pipes it through the Reader interface with these options enabled can be knocked over by a single crafted document, which matters most for long-lived or shared parsing workers. As of 25 August 2026, CVE-2024-58378 does not appear in the CISA Known Exploited Vulnerabilities catalog, and neither the NVD record nor the Nokogiri security advisory (GHSA-xc9x-jj77-9p9j) reports exploitation in the wild.
What's Vulnerable
Affected package: pkg:gem/nokogiri (vendor: sparklemotion).
- All versions before 1.15.6
- The 1.16.x line before 1.16.2
The flaw only applies to CRuby installations using the packaged libxml2. JRuby installations and installations linked against system libxml2 are not affected. Exposure additionally requires use of the XML Reader interface with DTD validation and XInclude expansion enabled.
Patch Status
Fixed. Upgrade to Nokogiri 1.15.6 or 1.16.2, which resolve the issue by upgrading the packaged libxml2 to 2.11.7 and 2.12.5 respectively. Installations already using a patched system libxml2 are unaffected by the bundled-library path.
Sources
- NVD, CVE-2024-58378: https://nvd.nist.gov/vuln/detail/CVE-2024-58378
- Nokogiri GitHub Security Advisory (GHSA-xc9x-jj77-9p9j): https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
- Nokogiri fix commit: https://github.com/sparklemotion/nokogiri/commit/92721970
- VulnCheck Advisory: https://www.vulncheck.com/advisories/nokogiri-before-use-after-free-via-xmltextreader
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog