CVE-2026-79771: Nokogiri before 1.19.3 Memory Leak via XSLT Transform
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nokogirito a version that resolves this vulnerability.Fixed in 1.19.3
Event History
Frequently Asked Questions
Which deployments are realistically exposed to denial of service?
Long-running processes using Nokogiri's XSLT Stylesheet transform method are exposed if they process attacker-controlled Ruby strings that can contain null bytes as transform parameters. Repeated requests can cause leaked heap allocations and exhaust process memory.
What conditions are required for exploitation?
An attacker needs a way to supply input containing null bytes to parameters passed into the XSLT Stylesheet transform method. No privileges or user interaction are required according to the supplied severity vector.
What version should be used to remediate the issue?
Upgrade Nokogiri to version 1.19.3 or later. The issue affects versions before 1.19.3.
What can be done if an upgrade cannot be applied immediately?
Prevent untrusted input containing null bytes from reaching XSLT transform parameters. This reduces the ability to trigger the memory leak while patching is pending.