Skip to main content

Nokogiri CVE-2026-79770

| EUVDEUVD-2026-65528 HIGH
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-08-25 VulnCheck GHSA-5jhf-fpp7-v2pv
Denial Of Service Nokogiri
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-delivered unauthenticated input triggers CPU exhaustion with no scope change; no confidentiality or integrity impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 25, 2026 - 17:17 EUVD
Source Code Evidence Fetched
Aug 25, 2026 - 16:05 vuln.today
Analysis Generated
Aug 25, 2026 - 16:05 vuln.today
CVE Published
Aug 25, 2026 - 15:16 cve.org
HIGH 8.7

DescriptionCVE.org

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

AnalysisAI

Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenizer, affecting string-literal and identifier tokenization. Any Ruby application passing attacker-controlled input to Node#css, Node#at_css, Nokogiri::CSS.xpath_for, Searchable#search, or CSS::Parser#parse is vulnerable to exponential regex backtracking that can exhaust CPU resources and deny service. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted CSS selector via HTTP request
Delivery
Application passes input to Node#css or equivalent
Exploit
CSS tokenizer evaluates adversarial regex pattern
Execution
Exponential backtracking exhausts CPU
Persist
Application thread hangs or times out
Impact
Denial of service to concurrent users
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application passes attacker-controlled text directly into one of the affected CSS selector methods: `Nokogiri::CSS.xpath_for`, `Node#css`, `Node#at_css`, `Searchable#search`, or `CSS::Parser#parse`. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) indicates a network-exploitable, low-complexity, unauthenticated attack with high availability impact, consistent with the vendor's own CVSS 3.1 assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - the difference reflects the CVSS 4.0 scoring scale rather than a substantive disagreement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a crafted CSS selector - such as a deeply hex-escaped identifier or an unterminated quoted string - through an application feature that passes user input to a Nokogiri CSS selector method such as `Node#css`. The Ruby regex engine enters exponential backtracking, consuming 100% CPU for an extended period or until a process-level timeout, denying service to concurrent users. …
Remediation Vendor-released patch: Nokogiri 1.19.3. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all Ruby applications to identify those using Nokogiri and determine which accept user-controlled input to vulnerable CSS parsing methods including Node#css, Node#at_css, Nokogiri::CSS.xpath_for, Searchable#search, and CSS::Parser#parse. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nokogiri

View all
CVE-2022-29181 HIGH POC
8.2 May 20

Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
CVE-2019-5477 CRITICAL
9.8 Aug 16

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
CVE-2025-71407 CRITICAL
9.3 Aug 25

Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bu
CVE-2025-71406 HIGH
8.7 Aug 25

Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and pr
CVE-2026-79769 HIGH
8.7 Aug 25

Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code
CVE-2025-71346 HIGH
8.7 Aug 25

Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
CVE-2022-23476 HIGH
7.5 Dec 08

Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this

CVE-2022-24836 HIGH
7.5 Apr 11

Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
CVE-2021-41098 HIGH
7.5 Sep 27

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
CVE-2026-79772 MEDIUM
6.9 Aug 25

Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to
CVE-2026-79771 MEDIUM
6.9 Aug 25

Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against

CVE-2026-57235 MEDIUM
6.3 Jun 25

Out-of-bounds read in Nokogiri's `NodeSet#[]` method (all versions before 1.19.4) enables an attacker who can supply a l

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-48801 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7
CVE-2024-21490 HIGH POC
7.5
CVE-2022-42969 HIGH POC
7.5
CVE-2015-8315 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-79770 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy