AZL-113335: CVE-2026-126062 affecting package rubygem-nokogiri 1.19.4-1

Q: Which deployments are affected?

Only applications running Nokogiri on JRuby are affected. CRuby deployments and applications using Nokogiri's default parse options are not affected.

Q: What conditions are required for exploitation?

The application must parse untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled. An attacker must be able to supply an external DTD or entity using a short-form IPv4 host or an absolute path resolved against a network URL.

Q: What is the impact of a successful exploit?

The NONET restriction can be bypassed, causing the XML resolver to make a network request. This can potentially enable server-side request forgery.

Q: What should be done if the package cannot be updated immediately?

Avoid parsing untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled on JRuby. Default parse options are not affected.

Q: What version fixes the issue?

The issue is fixed in Nokogiri version 1.19.5. The affected package version listed is rubygem-nokogiri 1.19.4-1.

Published Nov 10, 2026

Updated

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.

Affected Software

1 affected component

azure-linux/rubygem-nokogiri<=1.19.4-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rubygem-nokogiri to a version that resolves this vulnerability.
Fixed in 1.19.5

Event History

Nov 10, 2026

Advisory Published

via OSV·08:19 PM

Data Sourced

via OSV·08:19 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-126062

Frequently Asked Questions

Which deployments are affected?

Only applications running Nokogiri on JRuby are affected. CRuby deployments and applications using Nokogiri's default parse options are not affected.

What conditions are required for exploitation?

The application must parse untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled. An attacker must be able to supply an external DTD or entity using a short-form IPv4 host or an absolute path resolved against a network URL.

What is the impact of a successful exploit?

The NONET restriction can be bypassed, causing the XML resolver to make a network request. This can potentially enable server-side request forgery.

What should be done if the package cannot be updated immediately?

Avoid parsing untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled on JRuby. Default parse options are not affected.

What version fixes the issue?

The issue is fixed in Nokogiri version 1.19.5. The affected package version listed is rubygem-nokogiri 1.19.4-1.

AZL-113335: CVE-2026-126062 affecting package rubygem-nokogiri 1.19.4-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are affected?

What conditions are required for exploitation?

What is the impact of a successful exploit?

What should be done if the package cannot be updated immediately?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What conditions are required for exploitation?

What is the impact of a successful exploit?

What should be done if the package cannot be updated immediately?

What version fixes the issue?