45 matches found
CVE-2026-79769
Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...
CVE-2026-79769 Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args
Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...
CVE-2026-79769 Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args
Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...
EUVD-2026-65527
Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...
CVE-2026-79769
Nokogiri (Ruby gem) versions before 1.19.4 contain an out-of-bounds memory read in the protected internal method Node#initialize_copy_with_args , which unwraps its source argument as an xmlNode without a type check. If application code calls this method with a non-Node argument (e.g., a Namespace...
CVE-2026-79769
Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...
CVE-2024-58378
Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude...
CVE-2023-54354
Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3 , which contains NULL pointer dereference vulnerabilities in XML Schema processing functions (xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK ). An attacker supplying a crafted o...
CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
Linux Distros Unpatched Vulnerability : CVE-2026-57236
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Documentencoding= with an invalid encoding e.g., a...
CVE-2026-57235
CVE-2026-57235 affects Nokogiri (Ruby) prior to 1.19.4. The bug is in Nokogiri::XML::NodeSet#[] (and #slice) where the index check used a 32‑bit truncated copy, allowing a large negative index to pass bounds checks and be used with full width. Result: on CRuby an out‑of‑bounds read that typically...
CVE-2026-57236
CVE-2026-57236 affects Nokogiri (Ruby) with the CRuby/libxml2 backend. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., non-string or null byte) frees the current encoding string but does not replace it, leaving the document referencing freed memory. The next call to Do...
EUVD-2026-39419
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Documentencoding= with an invalid encoding e.g., a non-string, or a string containing a null byte raises an exception, but only after freeing the document's current encoding string without...
GHSA-WFPW-MMFH-QQ69 Nokogiri: Possible Use-After-Free in XInclude Processing
Summary XInclude substitution performed by Nokogiri::XML::Nodedoxinclude replaced each in place, freeing the include node along with its children such as and its descendants and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the...
GHSA-WJV4-X9W8-WM3H Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
Summary Nokogiri::XML::Documentroot= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. Nokogiri...
ruby: Murmur hash-flooding DoS flaw in ruby 1.9 (oCERT-2012-001)
Ruby aka CRuby 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains...
GHSA-WX95-C6CV-8532 Nokogiri does not check the return value from xmlC14NExecute
Summary Nokogiri's CRuby extension fails to check the return value from xmlC14NExecute in the method Nokogiri::XML::Documentcanonicalize and Nokogiri::XML::Nodecanonicalize. When canonicalization fails, an empty string is returned instead of raising an exception. This incorrect return value may...
Unchecked Return Value
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Unchecked Return Value from xmlC14NExecute, used in the canonicalize methods. These return and empty string rather than an error code for invalid and incomplete XML inputs...