CVE-2024-34459
published 2026-08-25CVE-2024-34459: Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
2.30%
82.3th percentile
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | backend-rhel8 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp2 | toolbox-rhel9 | — | — |
| 3scale-amp2 | zync-rhel9 | — | — |
| debian | libxml2 | < libxml2 2.9.14+dfsg-1.3~deb12u2 (bookworm) | libxml2 2.9.14+dfsg-1.3~deb12u2 (bookworm) |
| msrc | azl3_libxml2_2.11.5-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_libxml2_2.11.5-5_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libxml2_2.10.4-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_libxml2_2.10.4-6_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| nokogiri | nokogiri | >= 0 < 1.16.5 | 1.16.5 |
| sparklemotion | nokogiri | < 1.16.5 | 1.16.5 |
| xmlsoft | libxml2 | < 2.11.8 | 2.11.8 |
| xmlsoft | libxml2 | >= 0 < 2.9.10+dfsg-6.7+deb11u8 | 2.9.10+dfsg-6.7+deb11u8 |
| xmlsoft | libxml2 | >= 0 < 2.9.14+dfsg-1.3~deb12u2 | 2.9.14+dfsg-1.3~deb12u2 |
| xmlsoft | libxml2 | >= 0 < 2.12.7+dfsg+really2.9.14-0.4 | 2.12.7+dfsg+really2.9.14-0.4 |
| xmlsoft | libxml2 | >= 0 < 2.12.7+dfsg+really2.9.14-0.4 | 2.12.7+dfsg+really2.9.14-0.4 |
| xmlsoft | libxml2 | >= 0 < 2.9.10+dfsg-5ubuntu0.20.04.9 | 2.9.10+dfsg-5ubuntu0.20.04.9 |
| xmlsoft | libxml2 | >= 0 < 2.9.10+dfsg-5ubuntu0.20.04.8 | 2.9.10+dfsg-5ubuntu0.20.04.8 |
| xmlsoft | libxml2 | >= 0 < 2.9.13+dfsg-1ubuntu0.6 | 2.9.13+dfsg-1ubuntu0.6 |
| xmlsoft | libxml2 | >= 0 < 2.9.13+dfsg-1ubuntu0.5 | 2.9.13+dfsg-1ubuntu0.5 |
| xmlsoft | libxml2 | >= 0 < 2.9.14+dfsg-1.3ubuntu3.2 | 2.9.14+dfsg-1.3ubuntu3.2 |
| xmlsoft | libxml2 | >= 0 < 2.9.14+dfsg-1.3ubuntu3.1 | 2.9.14+dfsg-1.3ubuntu3.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ghsa7.5HIGH
osv7.8HIGH
vendor_ubuntu8.1HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool.
ghsa_unreviewed·2026-08-25·CVSS 7.5
CVE-2024-58377 [HIGH] CWE-427 Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool.
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.
VulDB
xmllint up to 2.11.7/2.12.6 Error Message xmllint.c xmlHTMLPrintFileContext buffer overflow (Nessus ID 207713 / WID-SEC-2026-1687)
vuldb·2026-05-28·CVSS 7.5
CVE-2024-34459 [HIGH] xmllint up to 2.11.7/2.12.6 Error Message xmllint.c xmlHTMLPrintFileContext buffer overflow (Nessus ID 207713 / WID-SEC-2026-1687)
A vulnerability classified as critical was found in xmllint up to 2.11.7/2.12.6. The affected element is the function xmlHTMLPrintFileContext of the file xmllint.c of the component Error Message Handler. Such manipulation leads to buffer overflow.
This vulnerability is traded as CVE-2024-34459. Access to the local network is required for this attack to succeed. There is no exploit available.
Upgrading the affected component is advised.
OSV
libxml2 vulnerabilities
osv·2025-02-25·CVSS 7.8
CVE-2022-49043 [HIGH] libxml2 vulnerabilities
libxml2 vulnerabilities
It was discovered that libxml2 incorrectly handled certain memory
operations. A remote attacker could use this issue to cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. (CVE-2022-49043)
It was discovered that the libxml2 xmllint tool incorrectly handled
certain memory operations. If a user or automated system were tricked into
running xmllint on a specially crafted xml file, a remote attacker could
cause xmllint to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2024-34459)
It was discovered that libxml2 did not properly manage memory. An attacker
could poss
OSV
libxml2 vulnerabilities
osv·2025-01-29·CVSS 7.8
CVE-2022-49043 [HIGH] libxml2 vulnerabilities
libxml2 vulnerabilities
It was discovered that libxml2 incorrectly handled certain memory
operations. A remote attacker could use this issue to cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2022-49043)
It was discovered that the libxml2 xmllint tool incorrectly handled
certain memory operations. If a user or automated system were tricked into
running xmllint on a specially crafted xml file, a remote attacker could
cause xmllint to crash, resulting in a denial of service. (CVE-2024-34459)
GHSA
Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
ghsa·2024-05-14·CVSS 7.5
CVE-2024-34459 [HIGH] CWE-119 Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-r95h-9x8f-r3f7. This link is maintained to preserve external references.
## Original Description
## Summary
Nokogiri v1.16.5 upgrades its dependency libxml2 to
[2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) from 2.12.6.
libxml2 v2.12.7 addresses CVE-2024-34459:
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53
## Impact
There is no impact to Nokogiri users because the issue is present only
in libxml2's `xmllint` tool which Nokogiri does not provide or expose.
## Timeline
- 2024-05-13 05:57 EDT, l
OSV
Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
osv·2024-05-14·CVSS 7.5
CVE-2024-34459 [HIGH] Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-r95h-9x8f-r3f7. This link is maintained to preserve external references.
## Original Description
## Summary
Nokogiri v1.16.5 upgrades its dependency libxml2 to
[2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) from 2.12.6.
libxml2 v2.12.7 addresses CVE-2024-34459:
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53
## Impact
There is no impact to Nokogiri users because the issue is present only
in libxml2's `xmllint` tool which Nokogiri does not provide or expose.
## Timeline
- 2024-05-13 05:57 EDT, l
OSV
CVE-2024-34459: An issue was discovered in xmllint (from libxml2) before 2
osv·2024-05-14·CVSS 7.5
CVE-2024-34459 [HIGH] CVE-2024-34459: An issue was discovered in xmllint (from libxml2) before 2
An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
GHSA
GHSA-vv62-jfwq-693v: An issue was discovered in xmllint (from libxml2) before 2
ghsa_unreviewed·2024-05-14
CVE-2024-34459 [HIGH] CWE-122 GHSA-vv62-jfwq-693v: An issue was discovered in xmllint (from libxml2) before 2
An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
GHSA
Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
ghsa·2024-05-13·CVSS 7.5
CVE-2024-34459 [HIGH] CWE-120 Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
## Summary
Nokogiri v1.16.5 upgrades its dependency libxml2 to [2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) from 2.12.6.
libxml2 v2.12.7 addresses CVE-2024-34459:
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53
## Impact
There is no impact to Nokogiri users because the issue is present only in libxml2's `xmllint` tool which Nokogiri does not provide or expose.
## Timeline
- 2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced
- 2024-05-13 08:30 EDT, nokogiri maintainers begin triage
- 2024-05-13 10:05 EDT, nokogiri [v1.16.5 is released](https://github.com/sparklemotion/nokogiri/releases/tag/v1.1
OSV
Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
osv·2024-05-13·CVSS 7.5
CVE-2024-34459 [HIGH] Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
## Summary
Nokogiri v1.16.5 upgrades its dependency libxml2 to [2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) from 2.12.6.
libxml2 v2.12.7 addresses CVE-2024-34459:
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53
## Impact
There is no impact to Nokogiri users because the issue is present only in libxml2's `xmllint` tool which Nokogiri does not provide or expose.
## Timeline
- 2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced
- 2024-05-13 08:30 EDT, nokogiri maintainers begin triage
- 2024-05-13 10:05 EDT, nokogiri [v1.16.5 is released](https://github.com/sparklemotion/nokogiri/releases/tag/v1.1
Red Hat
rubygem-nokogiri: Nokogiri before 1.16.5 libxml2 Dependency Update
vendor_redhat·2026-08-25·CVSS 7.5
CVE-2024-58377 [HIGH] CWE-126 rubygem-nokogiri: Nokogiri before 1.16.5 libxml2 Dependency Update
rubygem-nokogiri: Nokogiri before 1.16.5 libxml2 Dependency Update
Nokogiri before 1.16.5, when using bundled libxml2, is affected by the libxml2 flaw CVE-2024-34459.
Statement: This CVE does not represent a flaw in Nokogiri, but is rather a duplicate assignment for different CVEs affecting libxml2 or libxslt.
The rubygem-nokogiri packages as shipped in Red Hat products do not bundled libxml2 and libxslt, but rather use system packages of those libraries. This CVE is therefore not applicable to the rubygem-nokogiri packages provided by Red Hat.
Package: 3scale-amp2/backend-rhel8 (Red Hat 3scale API Management Platform 2) - Under investigation
Package: 3scale-amp2/system-rhel8 (Red Hat 3scale API Management Platform 2) - Under investigation
Package: 3scale-amp2/system-rhel9 (Red Hat 3s
Ubuntu
libxml2 vulnerabilities
vendor_ubuntu·2025-02-25·CVSS 8.1
CVE-2022-49043 [HIGH] libxml2 vulnerabilities
Title: libxml2 vulnerabilities
Summary: Several security issues were fixed in libxml2.
It was discovered that libxml2 incorrectly handled certain memory
operations. A remote attacker could use this issue to cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. (CVE-2022-49043)
It was discovered that the libxml2 xmllint tool incorrectly handled
certain memory operations. If a user or automated system were tricked into
running xmllint on a specially crafted xml file, a remote attacker could
cause xmllint to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2024-34459)
It was discovered tha
Ubuntu
libxml2 vulnerabilities
vendor_ubuntu·2025-01-29·CVSS 8.1
CVE-2024-34459 [HIGH] libxml2 vulnerabilities
Title: libxml2 vulnerabilities
Summary: Several security issues were fixed in libxml2.
It was discovered that libxml2 incorrectly handled certain memory
operations. A remote attacker could use this issue to cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2022-49043)
It was discovered that the libxml2 xmllint tool incorrectly handled
certain memory operations. If a user or automated system were tricked into
running xmllint on a specially crafted xml file, a remote attacker could
cause xmllint to crash, resulting in a denial of service. (CVE-2024-34459)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext i
vendor_msrc·2024-05-14·CVSS 7.5
CVE-2024-34459 [HIGH] CWE-122 An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext i
An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we wil
Red Hat
libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c
vendor_redhat·2024-05-08·CVSS 7.5
CVE-2024-34459 [HIGH] CWE-126 libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c
libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c
An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
A flaw was found in the xmllint program distributed by the libxml2 package. A buffer over-read in the xmlHTMLPrintFileContext function in the xmllint.c file may be triggered when a crafted file is processed with the xmllint program using the `--htmlout` command line option, causing an application crash and resulting in a denial of service.
Statement: This issue only affects the xmllint program when the `--htmlout' command line option is used. Additionally, an application is not vulnerable if it does not use or ex
Debian
CVE-2024-34459: libxml2 - An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x befor...
vendor_debian·2024·CVSS 7.5
CVE-2024-34459 [HIGH] CVE-2024-34459: libxml2 - An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x befor...
An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
Scope: local
bookworm: resolved (fixed in 2.9.14+dfsg-1.3~deb12u2)
bullseye: resolved (fixed in 2.9.10+dfsg-6.7+deb11u8)
forky: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4)
sid: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4)
trixie: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-58377 rubygem-nokogiri: Nokogiri before 1.16.5 libxml2 Dependency Update
bugzilla·2026-08-25·CVSS 7.5
CVE-2024-58377 [HIGH] CVE-2024-58377 rubygem-nokogiri: Nokogiri before 1.16.5 libxml2 Dependency Update
CVE-2024-58377 rubygem-nokogiri: Nokogiri before 1.16.5 libxml2 Dependency Update
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.
Bugzilla
CVE-2024-34459 libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c
bugzilla·2024-05-15·CVSS 7.5
CVE-2024-34459 [HIGH] CVE-2024-34459 libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c
CVE-2024-34459 libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c
An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
Reference:
https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
Upstream patches:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/3ad7f81624572ebd5b9e6058c9f67d38207c10e2
https://gitlab.gnome.org/GNOME/libxml2/-/commit/8ddc7f13337c9fe7c6b6e616f404b0fffb8a5145
https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac5392a4e891b81e40e592c3ac6cb46016ce
Discussion:
Created libxml2 tracking bugs for this issue:
Affects: fedora-all [bug 2280539]
Created mingw-libxml2 tracking bugs for this issue:
Affec
arXiv
Fuzzing: Randomness? Reasoning! Efficient Directed Fuzzing via Large Language Models
arxiv_fulltext·2025-06-30
Fuzzing: Randomness? Reasoning! Efficient Directed Fuzzing via Large Language Models
Large Language Model Assisted Directed Fuzzing:\ First, Then Fuzzing
Fuzzing: Randomness? Reasoning! \ Directed Fuzzing via Large Language Models
Xiaotao Feng
360 Security Technology Inc.
Beijing, China
[email protected]
Xiaogang Zhu
School of Computer and Mathematical Sciences
The University of Adelaide
Adelaide, SA, Australia
[email protected]
Kun Hu
School of Science
Edith Cowan University
Joondalup, WA, Australia
[email protected]
Jincheng Wang
360 Security Technology Inc.
Beijing, China
[email protected]
Yingjie Cao
360 Security Technology Inc.
Beijing, China
[email protected]
Guang Gong
360 Security Technology Inc.
Beijing, China
[email protected]
Jianfeng Pan
360 Security Technology Inc.
Beijing, China
[email protected]
## Abstrac
2026-08-25
Published