Parser crash via fixed-width hashmap copy
Published Jun 22, 2025 · Updated Jun 30, 2025
Heap-based buffer overflow in Nokogiri's unreleased C Gumbo parser allows local users to crash parsing by supplying crafted HTML. hashmap_set_with_hash copies eight bytes from a variable-length attribute-name buffer even when fewer bytes were allocated, causing an out-of-bounds read. Reproduction requires locally executing an affected source checkout with the C implementation; upstream states that no published Nokogiri release contained the code.
Summary
What happened
Heap-based buffer overflow in Nokogiri's unreleased C Gumbo parser allows local users to crash parsing by supplying crafted HTML. hashmap_set_with_hash copies eight bytes from a variable-length attribute-name buffer even when fewer bytes were allocated, causing an out-of-bounds read. Reproduction requires locally executing an affected source checkout with the C implementation; upstream states that no published Nokogiri release contained the code.
The record
- CVE
- CVE-2025-6490
- Published
- Jun 22, 2025
- Updated
- Jun 30, 2025
- Vendor
- Sparkle Motion
- Product
- Nokogiri
- Classifications
- CWE-122, CWE-119, T1499.004
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Jun 22, 2025CVE publishedPublication date reported by the CVE source.
- Jun 30, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=c29c920907366cb74af13b4dc2230e9c9e23b833
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- nokogiri_crash.txt parser reproducerproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo