3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6490

CVE-2025-6490: sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

Withdrawn Advisory

This advisory has been withdrawn because the affected code was never included in a release. This link has been maintained to preserve external references.

Original Description

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of the patch is ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6490

CVE-2025-6490:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nokogiri	rubygems	= 0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a heap-based buffer overflow in the hashmap implementation used by Nokogiri's Gumbo HTML5 parser. The root cause is a type confusion in how strings were stored in the hashmap. The hashmap was configured to store items of a fixed size (e.g., the size of a pointer), but the functions in gumbo-parser/src/string_set.c were passing variable-length strings directly as if they were the items themselves.

When a function like gumbo_string_set_insert was called with a string longer than the hashmap's item size, the underlying hashmap_set (and its internal counterpart hashmap_set_with_hash) would attempt to copy the oversized string into a smaller, fixed-size buffer on the heap, causing an overflow.

The patch addresses this by changing the logic to store pointers to strings (char**) in the hashmap instead of the string data itself. This is reflected in the changes to gumbo_string_set_insert and gumbo_string_set_contains, which now pass the address of the string pointer (&str). Consequently, the helper functions string_compare and string_hash were updated to dereference the pointers before using the string values.

Therefore, the vulnerable functions are the ones in string_set.c that incorrectly interacted with the hashmap API, leading to the memory corruption.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.