CVE-2025-6490: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-6490 is a heap-based buffer overflow vulnerability in the hashmap_set_with_hash function within gumbo-parser/src/hashmap.c of the sparklemotion nokogiri library. The flaw was discovered via fuzzing and reported on April 7, 2025 by Yifan Zhang; the fix was merged into the main branch on June 30, 2025, and the CVE was published on June 22, 2025. Notably, the project maintainer confirmed that the vulnerable code was merged into the main branch but never appeared in an official release, making the real-world exposure limited. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.9 (Low) (Red Hat CVE, Nokogiri Issue #3500).

The root cause is an improper memory copy operation in gumbo-parser/src/string_set.c where a character string of variable length was passed directly as a hashmap item, but the hashmap implementation always copied 8 bytes (the size of a pointer) into the item slot (CWE-122: Heap-based Buffer Overflow, CWE-119). When an HTML attribute name longer than 8 bytes was processed during tokenization, the hashmap_set call in gumbo_string_set_insert triggered a heap buffer over-read of 8 bytes past the allocated string buffer. The fix corrects this by passing a pointer-to-pointer (&str) so the hashmap stores the fixed-size pointer value rather than the variable-length string content. Exploitation requires local access and the ability to supply crafted HTML input with long attribute names to a nokogiri parsing function (Nokogiri Issue #3500, Nokogiri PR #3524, Patch Commit).

Successful exploitation causes a heap buffer overflow that results in a denial of service by crashing the nokogiri process; there is no impact on confidentiality or integrity. The vulnerability is limited to the C (gumbo) implementation used for HTML5 parsing and does not affect the Java implementation. Because the vulnerable code was never included in an official nokogiri release, the practical impact on production deployments is assessed as minimal (Red Hat CVE, Nokogiri Issue #3500).

A proof-of-concept crash input (nokogiri_crash.txt) was disclosed publicly alongside the bug report, discovered through fuzzing with AddressSanitizer and libFuzzer against the gumbo-parser fuzzing harness. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the near term (Nokogiri Issue #3500, Red Hat CVE).

1. Identify target: Confirm the target system is running a nokogiri build compiled from a commit between c29c920907366cb74af13b4dc2230e9c9e23b833 and the fix at ada4708e5a67114402cd3feb70a4e1d1d7cf773a on the main branch (note: no official release is affected).
2. Craft malicious HTML: Construct an HTML document containing a <span> element with one or more attribute names longer than 8 bytes (e.g., <span longattributename="value">).
3. Trigger parsing: Supply the crafted HTML to a nokogiri HTML5 parsing function (e.g., Nokogiri::HTML5::DocumentFragment.parse(html)) in a local execution context.
4. Trigger overflow: The tokenizer processes the long attribute name via finish_attribute_name → gumbo_string_set_insert → hashmap_set → hashmap_set_with_hash, where 8 bytes are copied from a buffer allocated for a shorter string, causing a heap buffer overflow and process crash (Nokogiri Issue #3500, Nokogiri PR #3524).

The fix is available as commit ada4708e5a67114402cd3feb70a4e1d1d7cf773a merged into the nokogiri main branch on June 30, 2025, and is targeted for inclusion in the v1.20.0 release. Since the vulnerable code was never part of an official release, users running any published nokogiri gem version are not affected and no immediate action is required. Organizations building nokogiri from source against the main branch between the affected commits should apply the patch or update to a commit at or after ada4708. IBM License Metric Tool v9 users should refer to the IBM security bulletin for applicable updates (Nokogiri PR #3524, IBM Bulletin).

The nokogiri maintainer (flavorjones) clarified in the GitHub pull request that the affected code was merged into main but never shipped in an official release, effectively limiting real-world exposure. A contributor (stevecheckoway) raised a follow-up concern about potential undefined behavior in the fix itself (using the address of a local variable as a hashmap value), which the maintainer acknowledged and planned to review further. Red Hat tracked the CVE and assessed it as low severity with no immediate impact on shipped packages (Nokogiri PR #3524, Red Hat CVE).