A vulnerability was found in sparklemotion nokogiri up to 1.18.7. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-6494
• sparklemotion/nokogiri#3508
• https://github.com/user-attachments/files/19825279/nokogiri_crash_2.txt
• https://vuldb.com/?ctiid.313611
• https://vuldb.com/?id.313611
• https://vuldb.com/?submit.601006