UBUNTU-CVE-2026-126064: Medium severity ubuntu/ruby-nokogiri vulnerability
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nokogirito a version that resolves this vulnerability.Fixed in 1.19.5
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use the CRuby native extension in Nokogiri versions before 1.19.5. JRuby is not affected.
What application behavior is required to trigger the issue?
Application code must access an existing attribute's child nodes, then replace that attribute value using Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. Later use of the still-reachable wrappers for the freed child nodes can cause an invalid read or process segfault.
What is the remediation?
Update Nokogiri to version 1.19.5 or later.