Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-79771

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

sparklemotion nokogiri

Default version status: unaffected

  • 0 to < 1.19.3affected
  • 1.19.3unaffected
pkg:gem/nokogiri

References