UBUNTU-CVE-2026-126062: Medium severity ubuntu/ruby-nokogiri vulnerability
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.5
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only applications using Nokogiri on JRuby are affected. CRuby is not affected, and applications using Nokogiri's default parse options are not affected.
What conditions are required for exploitation?
An application must parse untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled. An attacker must provide an external DTD or entity using a short-form IPv4 host or an absolute path resolved against a network URL.
What is the potential impact?
The NONET restriction can be bypassed and the XML resolver may make a network request. This can enable server-side request forgery.
What version fixes the issue?
The issue is fixed in Nokogiri version 1.19.5.