{"id":"CVE-2026-126062","state":"PUBLISHED","title":"Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","publishedAt":"2026-11-10T20:11:46.316Z","updatedAt":"2026-11-10T20:11:46.316Z","severity":{"score":3.7,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["sparklemotion nokogiri"],"affected":[{"vendor":"sparklemotion","product":"nokogiri","versions":[{"version":"< 1.19.5","status":"affected"}]}],"references":["https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm","https://github.com/sparklemotion/nokogiri/pull/3752","https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8","https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac","https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"],"weaknesses":["CWE-611","CWE-918"],"ingestedAt":"2026-11-10T20:20:06.681Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/126xxx/CVE-2026-126062.json","commit":"fc57b5d654d4e48fa8318f362c47d10daa8793b5","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-126062","state":"PUBLISHED","datePublished":"2026-11-10T20:11:46.316Z","dateUpdated":"2026-11-10T20:11:46.316Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-11-10T17:07:43.283Z"},"containers":{"cna":{"title":"Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set","descriptions":[{"lang":"en","value":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5."}],"affected":[{"vendor":"sparklemotion","product":"nokogiri","versions":[{"version":"< 1.19.5","status":"affected"}]}],"references":[{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm","name":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/sparklemotion/nokogiri/pull/3752","name":"https://github.com/sparklemotion/nokogiri/pull/3752","tags":["x_refsource_MISC"]},{"url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8","name":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8","tags":["x_refsource_MISC"]},{"url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac","name":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac","tags":["x_refsource_MISC"]},{"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5","name":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-611","lang":"en","description":"CWE-611: Improper Restriction of XML External Entity Reference","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-918","lang":"en","description":"CWE-918: Server-Side Request Forgery","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-11-10T20:11:46.316Z"},"source":{"advisory":"GHSA-v995-44v6-5fqm","discovery":"UNKNOWN"}}}}}