CVE-2025-6490 sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow
A heap-based buffer overflow in Nokogiri's hashmap allows local attackers to potentially execute code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-6490?
CVE-2025-6490 is a medium-severity memory corruption vulnerability in sparklemotion nokogiri, published on 22 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of the patch is ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.
Which versions are affected by CVE-2025-6490?
How do I fix CVE-2025-6490?
No fix has been published for CVE-2025-6490 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-6490 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6490 exists.