Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.

Nokogiri versions before 1.18.3 are affected by two vulnerabilities rooted in libxml2. The first is a stack buffer overflow triggered when reporting DTD validation errors involving long QName prefixes. The second is a use-after-free vulnerability that occurs during validation against untrusted XML Schemas (XSD files). Both vulnerabilities can be exploited by providing malicious DTD content or untrusted XSD files to affected applications. Successful exploitation may result in denial of service or potential arbitrary code execution. The vulnerabilities are tracked under CVE-2025-71407 and have been patched in Nokogiri 1.18.3. Users and maintainers relying on Nokogiri for XML parsing and validation should upgrade immediately.