https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T00:50:42.562389+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/brew-mikutter-cve-2025-71346 BREW-mikutter-CVE-2025-71346 — Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415 2026-10-01T00:50:42.632576+00:00

Affected: Homebrew: mikutter

## Summary

Nokogiri v1.18.8 upgrades its dependency libxml2 to [v2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8).

libxml2 v2.13.8 addresses:

- CVE-2025-32414 - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889 - CVE-2025-32415 - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890

## Impact

### CVE-2025-32414: No impact

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

**There is no impact** from this CVE for Nokogiri users.

### CVE-2025-32415: Low impact

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

In the upstream issue, further context is provided by the maintainer:

> The bug affects validation against untrusted XML Schemas (.xsd) and validation of untrusted > documents against trusted Schemas if they make use of xsd:keyref in combination with recursively > defined types that have additional identity constraints.

MITRE has published a severity score of 2.9 LOW (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.

 https://vulnerability.circl.lu/vuln/fkie_cve-2025-71346 fkie_cve-2025-71346 2026-10-01T00:50:42.632758+00:00

Rejected reason: This CVE ID has been rejected as a duplicate.

 https://vulnerability.circl.lu/vuln/ghsa-2ph4-3vr8-f2m3 GHSA-2ph4-3vr8-f2m3 2026-10-01T00:50:42.632803+00:00

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2025-71346 Withdrawn: UBUNTU-CVE-2025-71346 2026-10-01T00:50:42.632833+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: ruby-nokogiri, Ubuntu:16.04:LTS: ruby-nokogiri, Ubuntu:18.04:LTS: ruby-nokogiri, Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri, Ubuntu:24.04:LTS: ruby-nokogiri, Ubuntu:26.04:LTS: ruby-nokogiri

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity.