CVE-2025-6494

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6494
A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is named ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

1.7 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 3.1 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/sparklemotion/nokogiri/commit/ada4708e5a67114402cd3feb70a4e1d1d7cf773a
https://github.com/sparklemotion/nokogiri/issues/3508
https://github.com/sparklemotion/nokogiri/pull/3524
https://github.com/user-attachments/files/19825279/nokogiri_crash_2.txt
https://vuldb.com/?ctiid.313611
https://vuldb.com/?id.313611
https://vuldb.com/?submit.601006
Configurations

No configuration.

History

30 Jun 2025, 20:15

Type Values Removed Values Added
References
  • () https://github.com/sparklemotion/nokogiri/commit/ada4708e5a67114402cd3feb70a4e1d1d7cf773a -
  • () https://github.com/sparklemotion/nokogiri/pull/3524 -
Summary (en) A vulnerability was found in sparklemotion nokogiri up to 1.18.7. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. (en) A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is named ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.

23 Jun 2025, 20:16

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en sparklemotion nokogiri hasta la versión 1.18.7. Se ha clasificado como problemática. Afecta a la función hashmap_get_with_hash del archivo gumbo-parser/src/hashmap.c. La manipulación provoca un desbordamiento del búfer en el montón. Un ataque debe abordarse localmente. Se ha hecho público el exploit y puede que sea utilizado.

22 Jun 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-22 23:15

Updated : 2025-06-30 20:15

NVD link : CVE-2025-6494

Mitre link : CVE-2025-6494

CVE.ORG link : CVE-2025-6494

JSON object : View

Products Affected

No product.

CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-122

Heap-based Buffer Overflow