Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-79772

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

sparklemotion nokogiri

Default version status: unaffected

  • 1.5.1 to < 1.19.1affected
  • 1.19.1unaffected
pkg:gem/nokogiri

References