CVE-2025-6490

Name of the Vulnerable Software and Affected Versions: sparklemotion nokogiri versions up to 1.18.7

Description: A problem was found in the function hashmap set with hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Recommendations: To fix this issue, apply a patch with the identifier ada4708e5a67114402cd3feb70a4e1d1d7cf773a. As a temporary workaround, consider disabling the hashmap set with hash function until a patch is available. Restrict access to the gumbo-parser/src/hashmap.c file to minimize the risk of exploitation. Avoid using the hashmap set with hash function in the affected code until the issue is resolved.