CVE-2024-58378

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.15.6 Nokogiri versions 1.16.x prior to 1.16.2

Description CRuby installations using the packaged libxml2 are subject to a use-after-free issue within the xmlTextReader module, which supports Nokogiri::XML::Reader. A use-after-free occurs in the xmlValidatePopElement() function when the XML Reader interface is used with DTD validation and XInclude expansion enabled to process a specially crafted XML document. A use-after-free is a memory corruption flaw where an application continues to use a pointer after the memory it points to has been freed.

Recommendations Update Nokogiri versions prior to 1.15.6 to version 1.15.6. Update Nokogiri versions 1.16.x prior to 1.16.2 to version 1.16.2.