CVE-2026-126064lowCWE-416

CVE-2026-126064: falha de baixa gravidade em sparklemotion nokogiri

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`

Publicada em

Seguir esta CVE+ Monitorar nokogiri+ Monitorar nokogiri

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

5Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
sparklemotion · nokogiri
CVEs relacionadas — sparklemotion nokogiri

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24836HIGHInefficient Regular Expression Complexity in NokogiriEPSS 3.5%CVE-2022-29181HIGHImproper Handling of Unexpected Data Type in NokogiriEPSS 3.2%CVE-2022-23476HIGHUnchecked return value from xmlTextReaderExpand in NokogiriEPSS 1.8%CVE-2021-41098HIGHImproper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyEPSS 1.5%CVE-2020-26247LOWXXE in NokogiriEPSS 1.2%CVE-2026-79770HIGHNokogiri before 1.19.3 ReDoS via CSS selector tokenizerEPSS 0.5%