External risk intelligence

Nokogiri Use-After-Free in XML Reader Component.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2024-58378

Nokogiri is a widely used Ruby library for parsing XML/HTML. While it is often used in public-facing web applications to process user-supplied data, the vulnerability requires specific, non-default configurations (DTD validation and XInclude expansion enabled). Therefore, while it is reachable in many deployments, it is not inherently internet-facing by design in all common usage scenarios.

Use After Free

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a use-after-free vulnerability within the Nokogiri XML parsing library, specifically affecting certain configurations that process XML documents. The issue arises when a crafted XML document is processed under specific validation and expansion settings, potentially leading to system instability or unauthorized access. The main concern is confirming relevance and exposure to this specific configuration.

A flaw exists in XML processing logic.
Matters if using specific XML parsing configurations.
Confirm if affected configurations are in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted XML document to a Ruby application that uses Nokogiri for XML processing. If the application is configured with both Document Type Definition (DTD) validation and XML Include (XInclude) expansion enabled, processing this malicious document could lead to a use-after-free error in the underlying libxml2 library. This error, if successfully triggered, could allow an attacker to potentially execute arbitrary code or cause a denial of service.

No authentication or user interaction needed.
Processing a crafted XML document.
Potential for code execution or denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system stability and availability when processing specially crafted XML documents with DTD validation and XInclude expansion enabled. This impacts Ruby applications that use the Nokogiri XML Reader interface with these specific configurations.

System stability and availability.
Processing crafted XML documents.
Denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners, platform teams, and potentially vendor-management teams are likely responsible for addressing this vulnerability. The first practical step involves identifying all instances of Nokogiri using CRuby with packaged libxml2, confirming their reachability and criticality, and then assessing the risk to prioritize remediation efforts.

Confirm application ownership and exposure.
Verify usage of packaged libxml2.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Nokogiri and why is it used?

Nokogiri is a fundamental Ruby library designed for parsing and manipulating XML and HTML documents. Developers rely on it to transform, search, and extract data from web content or structured files. It acts as a wrapper around the powerful libxml2 C library, which provides the actual processing engine. Because it is highly efficient and flexible, it is a staple component in many Ruby-based web applications, backend services, and data integration pipelines that handle complex document structures.

What is the vulnerability in CVE-2024-58378?

This CVE describes a use-after-free weakness, categorized as CWE-416. In simple terms, this means the software attempts to access a segment of computer memory after it has already been cleared or released. Because this memory is no longer valid, accessing it can cause the program to crash or, in some cases, allow an attacker to hijack the program's execution flow. This specific flaw resides within the libxml2 library used by Nokogiri when performing certain XML reading tasks.

How is this Nokogiri vulnerability triggered?

The flaw is triggered only when the XML Reader interface is used with both DTD validation and XInclude expansion features enabled. These are specific settings that must be active for the bug to occur. If your application processes XML without these two advanced features turned on, it is not susceptible to this specific path. Additionally, installations using JRuby or the system-provided libxml2 rather than the Nokogiri-packaged version remain unaffected.

Do I need to worry about this CVE?

According to Halo Surface Signal, this vulnerability is considered possible rather than guaranteed to be internet-facing. Because it requires non-default, specific configurations to exploit, its reachability varies by application. You should prioritize assessing your environment if your Ruby applications explicitly enable DTD validation and XInclude expansion while using the packaged libxml2, as these specific choices create the necessary conditions for an attacker to reach the vulnerable code.

Is there a simple way to respond to this threat?

Your first step is to verify which version of Nokogiri and libxml2 your applications are currently running. Check your dependency files to see if you are using the CRuby implementation with the packaged libxml2. If you are, the recommended path is to update to the patched versions—1.15.6 or 1.16.2—which include the necessary upgrades to the libxml2 library. Coordinate this update within your standard maintenance cycles once you have confirmed your exposure.

References

github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.