7
CVEs
1
Critical
4
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
4
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-71407 | Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bundles a vulnerable libxml2. The flaw combines a stack buffer overflow when libxml2 reports DTD validation errors involving long (~3kb) QName prefixes (CVE-2025-24928) and a use-after-free during validation against untrusted XML Schemas using xsd:keyref with recursively defined types (CVE-2024-56171). Any Ruby/Rails application that validates attacker-supplied DTD or XSD content is exposed; no public exploit identified at time of analysis, and the issue is not in CISA KEV. | CRITICAL | 9.3 | 0.4% | 47 |
|
| CVE-2026-79770 | Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenizer, affecting string-literal and identifier tokenization. Any Ruby application passing attacker-controlled input to `Node#css`, `Node#at_css`, `Nokogiri::CSS.xpath_for`, `Searchable#search`, or `CSS::Parser#parse` is vulnerable to exponential regex backtracking that can exhaust CPU resources and deny service. No public exploit code has been identified at time of analysis, but the unauthenticated network attack surface and low exploitation complexity make this a high-priority patch target for Nokogiri-dependent Ruby applications. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2025-71406 | Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and process compromise when processing attacker-supplied XSLT stylesheets. The root cause is Nokogiri's bundled libxslt dependency (prior to v1.1.43), which contains two distinct UAF bugs: CVE-2025-24855 (XPath context node leaked by xsltEvalXPathStringNs) and CVE-2024-55549 (namespace prefix handling corruption). No public exploit code has been identified at time of analysis, and CISA KEV listing is absent; a vendor-released patch (Nokogiri 1.18.4) is available. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-79769 | Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code incorrectly passes a non-Node argument to the protected internal `Node#initialize_copy_with_args` method. The method backs the public `Node#dup` and `#clone` APIs and, prior to 1.19.4, unwraps its argument directly as a libxml2 `xmlNode` struct without verifying the object's type, causing it to misread an `xmlNs` (Namespace) struct out of bounds. Critically, the vendor explicitly confirms this cannot be triggered by untrusted external input - only by a programming error in application code - making the provided CVSS 4.0 score of 8.7 (AV:N/PR:N) a significant overstatement of real-world risk. No public exploit has been identified at time of analysis. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2025-71346 | Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior to 1.18.8, which bundle the vulnerable libxml2 library. The flaw in xmlSchemaIDCFillNodeTables can be triggered by supplying a crafted XSD schema or by submitting untrusted XML documents for validation against trusted schemas that combine xsd:keyref with recursively defined types carrying additional identity constraints. No public exploit has been identified at time of analysis, and upstream libxml2 maintainers and MITRE independently rate actual exploitability as low - in notable conflict with the NVD-assigned CVSS 4.0 base score of 8.7. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-79771 | Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against long-running Ruby applications that pass attacker-controlled input to `Nokogiri::XSLT::Stylesheet#transform` parameters containing null bytes. Each null-byte-bearing call leaks approximately 24-32 bytes of heap memory; meaningful service degradation requires sustained, high-rate malicious traffic against the specific code path. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV. Notably, the VulnCheck-reported CVSS 4.0 score of 6.9 is higher than the Nokogiri maintainers' own assessment of CVSS 5.3 Moderate, reflecting scoring convention differences rather than disagreement on impact. | MEDIUM | 6.9 | 0.3% | 35 |
|
| CVE-2026-79772 | Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. The JRuby implementation is not affected; exploitation has been confirmed as demonstrated by a HackerOne researcher but is not listed in CISA KEV. | MEDIUM | 6.9 | 0.3% | 35 |
|