CVE-2025-71407: Critical libxml2 Stack Buffer Overflow in Nokogiri (CVSS 9.8) — Detection and Remediation Guide

---
title: Ruby Process Spawning Shell or System Utility
description: Detects Ruby interpreter processes spawning shells or system utilities, consistent with post-exploitation activity after compromise of an XML-parsing Ruby application (e.g. libxml2 memory corruption via CVE-2025-71407).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-71407
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/14
id: 3f7c1a92-6b84-4d19-9e25-8a4c2f71d033
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/ruby'
      - '/ruby3.0'
      - '/ruby3.1'
      - '/ruby3.2'
      - '/ruby3.3'
      - '/puma'
      - '/sidekiq'
      - '/unicorn'
      - '/passenger'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Deployment tooling (Capistrano, Chef, Ansible runs invoking system commands from Ruby)
  - Legitimate rake tasks invoking shell commands
level: high
---
title: Web Worker Crash Loop Indicating Memory Corruption
description: Detects repeated crashes (SIGSEGV/SIGABRT) of Ruby application worker processes, consistent with attempted or successful triggering of a stack buffer overflow in libxml2 DTD validation (CVE-2025-71407).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-71407
author: Security Arsenal
date: 2026/02/14
id: 9d2e5b48-1c63-4f07-b3a1-6e8d4a52c907
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'kernel: '
      - 'segfault'
      - 'general protection fault'
  selection_target:
    CommandLine|contains:
      - 'ruby'
      - 'puma'
      - 'sidekiq'
      - 'unicorn'
      - 'rails'
      - 'passenger'
  condition: selection and selection_target
falsepositives:
  - Unrelated application instability; correlate with XML ingestion endpoints and patch state
level: medium

// Hunt: Ruby application workers spawning shells or download tools
// Relevant to post-exploitation of XML parsing flaws (CVE-2025-71407, libxml2 in Nokogiri)
// Tables cover both MDE-on-Linux (DeviceProcessEvents) and Syslog/CEF ingestion
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("ruby", "puma", "sidekiq", "unicorn", "passenger", "rails")
   or InitiatingProcessCommandLine has_any ("puma", "sidekiq", "rails server")
| where FileName has_any ("sh", "bash", "dash", "zsh", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc
;
// Companion: Syslog crash telemetry for Ruby workers (segfaults during DTD/XML parsing)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("segfault", "general protection fault", "SIGABRT", "stack smashing detected")
| where SyslogMessage has_any ("ruby", "puma", "sidekiq", "rails", "libxml")
| summarize CrashCount = count() by Computer, bin(TimeGenerated, 1h)
| where CrashCount >= 3
| order by CrashCount desc

-- Velociraptor artifact: inventory Nokogiri gem versions and flag CVE-2025-71407 exposure
-- Scans installed gem specifications across hosts; flags anything below 1.18.3
SELECT FullPath,
       parse_string_with_regex(string=FullPath,
          regex='nokogiri-(?P<Version>[0-9]+\\.[0-9]+\\.[0-9]+)').Version AS NokogiriVersion,
       read_file(filename=FullPath, length=2000) AS GemspecHeader
FROM glob(globs=['/var/lib/gems/*/specifications/nokogiri-*.gemspec',
                 '/usr/local/lib/ruby/gems/*/specifications/nokogiri-*.gemspec',
                 '/usr/lib/ruby/gems/*/specifications/nokogiri-*.gemspec',
                 '/opt/*/vendor/bundle/ruby/*/specifications/nokogiri-*.gemspec',
                 '/home/*/.rbenv/versions/*/lib/ruby/gems/*/specifications/nokogiri-*.gemspec',
                 '/usr/local/bundle/specifications/nokogiri-*.gemspec'])
WHERE NokogiriVersion < '1.18.3'

#!/bin/bash
# CVE-2025-71407 remediation/verification: Nokogiri vendored libxml2 stack buffer overflow
# Run on Ruby application hosts and in container build pipelines.

set -euo pipefail

echo "=== [1] Enumerate installed Nokogiri versions ==="
gem list nokogiri --all 2>/dev/null || true
# Also check bundler-locked versions per application
find / -name 'Gemfile.lock' -not -path '*/proc/*' 2>/dev/null | while read -r lock; do
  ver=$(grep -E '^\s+nokogiri \(' "$lock" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
  [ -n "$ver" ] && echo "$lock -> nokogiri $ver"
done

echo "=== [2] Check whether Nokogiri uses vendored or system libxml2 ==="
for lock in $(find / -name 'Gemfile.lock' -not -path '*/proc/*' 2>/dev/null); do
  appdir=$(dirname "$lock")
  (cd "$appdir" && ruby -rnokogiri -e \
    'puts "#{File.dirname("$0")}: Nokogiri #{Nokogiri::VERSION} / libxml2 #{Nokogiri::LIBXML2_VERSION} (#{Nokogiri.uses_system_libraries? ? "SYSTEM" : "VENDORED"})"' \
    2>/dev/null || true)
done

echo "=== [3] Remediate: upgrade to Nokogiri >= 1.18.3 ==="
# Per-application (preferred — respects lockfile):
#   bundle update nokogiri --conservative
# System-wide fallback:
#   gem update nokogiri

echo "=== [4] Verify post-patch ==="
ruby -rnokogiri -e \
  'abort("STILL VULNERABLE: #{Nokogiri::VERSION}") if Gem::Version.new(Nokogiri::VERSION) < Gem::Version.new("1.18.3"); puts "OK: Nokogiri #{Nokogiri::VERSION} / libxml2 #{Nokogiri::LIBXML2_VERSION}"'

echo "=== [5] If system libxml2 is used, patch the OS package too ==="
# Debian/Ubuntu:  apt-get update && apt-get install --only-upgrade libxml2
# RHEL/Rocky:     dnf update libxml2
# Alpine:         apk upgrade libxml2