PT-2025-26571 · Sparklemotion+1 · Nokogiri+1
Jjleo
·
Published
2025-06-22
·
Updated
2025-06-30
·
CVE-2025-6494
CVSS v3.1
3.3
Low
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions:
sparklemotion nokogiri versions up to 1.18.7
Description:
A vulnerability was found in sparklemotion nokogiri, affecting the function
hashmap get with hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.Recommendations:
To fix this issue, apply the patch named ada4708e5a67114402cd3feb70a4e1d1d7cf773a. As a temporary workaround, consider disabling the
hashmap get with hash function until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the vulnerable function in the affected API endpoint until the issue is resolved.Exploit
Fix
Buffer Overflow
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Nokogiri