Skip to main content

Nokogiri CVE-2026-57235

| EUVDEUVD-2026-39422 MEDIUM
Out-of-bounds Read (CWE-125)
2026-06-25 GitHub_M
Buffer Overflow Information Disclosure Red Hat Suse Nokogiri Sparklemotion
6.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.8 MEDIUM

AC:H because exploitation requires the application to forward attacker-controlled integers to NodeSet#[], a non-default code path; C:L for potential heap disclosure and A:L for process crash on CRuby; no integrity or scope impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jun 25, 2026 - 16:03 EUVD
Source Code Evidence Fetched
Jun 25, 2026 - 15:21 vuln.today
Analysis Generated
Jun 25, 2026 - 15:21 vuln.today

DescriptionCVE.org

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This vulnerability is fixed in 1.19.4.

AnalysisAI

Out-of-bounds read in Nokogiri's NodeSet#[] method (all versions before 1.19.4) enables an attacker who can supply a large negative integer index to bypass a 32-bit-truncated bounds check and trigger a read outside the node set's allocated memory. On CRuby (MRI Ruby), this typically crashes the process - denial of service - with ancillary potential for heap memory disclosure; on JRuby, the runtime's managed memory prevents memory corruption, but an incorrect node is silently returned. No public exploit or active exploitation has been identified; exploitation requires the target application to forward attacker-controlled integers directly to the NodeSet#[] or #slice API.

Technical ContextAI

Nokogiri (CPE: cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:*) is a widely-used Ruby gem providing bindings to libxml2 and libxslt for XML and HTML parsing. The root cause (CWE-125, Out-of-bounds Read) is an integer-width mismatch in the bounds validation of Nokogiri::XML::NodeSet#[] and its alias #slice: the supplied index was compared against the node set's length using a 32-bit-truncated copy of the value, while the subsequent array access used the full native-width (64-bit) integer. A sufficiently large negative integer wraps around when truncated to 32 bits, appearing to fall within the valid range and passing the check, but then dereferences far outside the allocated buffer at full pointer width. This class of bug - comparing with a narrowed copy but indexing with the original - is a classic signed integer truncation vulnerability. The divergent impact between CRuby and JRuby is explained by runtime memory model differences: CRuby operates on raw native memory, making the out-of-bounds read a genuine safety violation, whereas JRuby's JVM-managed heap enforces array bounds independently, producing incorrect behavior rather than a memory hazard.

RemediationAI

Upgrade to Nokogiri 1.19.4 or later, which performs the NodeSet bounds check against the full-width index, eliminating the integer truncation flaw (confirmed fix version per GHSA-5prr-v3j2-97mh: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5prr-v3j2-97mh). If an immediate upgrade is not possible, validate any externally supplied integer against node_set.length before passing it to NodeSet#[] or #slice - for example, raise or clamp the value if it falls outside (-node_set.length..node_set.length - 1). This workaround must be applied at every call site in the application and does not fix the underlying library defect; it carries the risk of missed call sites and adds maintenance burden. Alternatively, refactor application logic to avoid forwarding untrusted integers directly as NodeSet indices. JRuby deployments do not face memory-safety risk but should still upgrade to prevent silent incorrect-node retrieval, which can produce logic errors in XML processing workflows.

More in Nokogiri

View all
CVE-2022-29181 HIGH POC
8.2 May 20

Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
CVE-2019-5477 CRITICAL
9.8 Aug 16

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
CVE-2025-71407 CRITICAL
9.3 Aug 25

Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bu
CVE-2026-79770 HIGH
8.7 Aug 25

Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenize
CVE-2025-71406 HIGH
8.7 Aug 25

Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and pr
CVE-2026-79769 HIGH
8.7 Aug 25

Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code
CVE-2025-71346 HIGH
8.7 Aug 25

Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
CVE-2022-23476 HIGH
7.5 Dec 08

Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this

CVE-2022-24836 HIGH
7.5 Apr 11

Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
CVE-2021-41098 HIGH
7.5 Sep 27

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
CVE-2026-79771 MEDIUM
6.9 Aug 25

Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against

CVE-2026-79772 MEDIUM
6.9 Aug 25

Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected
SUSE Linux Enterprise High Availability Extension 16.1 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-57235 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy