CVE-2025-6490
Public on 2025-06-22
        Modified on 2025-06-24
        
      Description
            
              A vulnerability was found in sparklemotion nokogiri up to 1.18.7 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
            
          Severity
          
          See what this means
        CVSS v3 Base Score
          
          See breakdown
        Affected Packages
| Platform | Package | Release Date | Advisory | Status | 
|---|---|---|---|---|
| Amazon Linux 1 | rubygem-nokogiri | No Fix Planned | ||
| Amazon Linux 1 | rubygem18-nokogiri | No Fix Planned | 
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | 
| NVD | CVSSv3 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | 
| NVD | CVSSv2 | 1.7 | AV:L/AC:L/Au:S/C:N/I:N/A:P |