CVE-2026-126062lowCWE-611CWE-918

CVE-2026-126062: fallo de gravedad baja en sparklemotion nokogiri

Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set

Publicada el

Seguir esta CVE+ Monitorear nokogiri+ Monitorear nokogiri

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

5Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.7
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
sparklemotion · nokogiri
CVEs relacionadas — sparklemotion nokogiri

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-24836HIGHInefficient Regular Expression Complexity in NokogiriEPSS 3.5%CVE-2022-29181HIGHImproper Handling of Unexpected Data Type in NokogiriEPSS 3.2%CVE-2022-23476HIGHUnchecked return value from xmlTextReaderExpand in NokogiriEPSS 1.8%CVE-2021-41098HIGHImproper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyEPSS 1.5%CVE-2020-26247LOWXXE in NokogiriEPSS 1.2%CVE-2026-79770HIGHNokogiri before 1.19.3 ReDoS via CSS selector tokenizerEPSS 0.5%