Skip to content
VulniPulse
Sign in
Highest advisory severityLow 1 vendor · 1 advisory

CVE-2025-71346

CVE-2025-71346: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityLow2.9

    Low [CVE-2025-71346] Heap buffer under-read in XML Schema validation

    CVE-2025-71346Source published Source updated

    Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity. This heap-based buffer under-read vulnerability, located in the xmlSchemaIDCFillNodeTables function, can be triggered when processing untrusted XML Schemas or documents. A remote attacker could exploit this by providing specially crafted XML input, which may lead to unexpected application…

    Affected products in this advisory
    • Red Hat 3scale API Management Platform 2
    • Red Hat Satellite 6
    Source-reported affected versions
    • < 1.18.8
    • < 2.13.8
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • No mitigation is currently available for this vulnerability. Red Hat recommends applying the appropriate security update as soon as it becomes available.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features