Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2025-71407 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
This CVE ID has been rejected as a duplicate.
CVE-2025-71407
✕ Withdrawn — historical dataCRITICALPre-NVD 9.8
9.8CVSS
- CVSS v3
- 9.8
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
August 25, 2026
Last Modified
September 1, 2026
References (2)
Frequently asked(4)
What is CVE-2025-71407?
CVE-2025-71407 is a rejected CVE ID: its record was withdrawn on September 1, 2026 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected as a duplicate.
When was the CVE record for CVE-2025-71407 published?
The CVE record for CVE-2025-71407 was published on August 25, 2026. EchelonGraph's copy of the record carries a last-modified date of September 1, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2025-71407?
CVE-2025-71407 has a CVSS base score of 9.8 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2025-71407?
There is nothing to remediate under CVE-2025-71407: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.