CVE-2026-79771
published 2026-08-25CVE-2026-79771: Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.42%
35.5th percentile
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | backend-rhel8 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp2 | toolbox-rhel9 | — | — |
| 3scale-amp2 | zync-rhel9 | — | — |
| nokogiri | nokogiri | < 1.19.3 | 1.19.3 |
| sparklemotion | nokogiri | < 1.19.3 | 1.19.3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes.
ghsa_unreviewed·2026-08-25
CVE-2026-79771 [MEDIUM] CWE-401 Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes.
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
Red Hat
nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak
vendor_redhat·2026-08-25·CVSS 5.3
CVE-2026-79771 [MEDIUM] CWE-770 nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak
nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
A flaw was found in Nokogiri. Attackers can exploit a memory leak in the XSLT Stylesheet transform method by providing specially crafted input containing null bytes. This can lead to excessive memory consumption and enable a denial of service against long-running processes.
Package: 3scale-amp2/backend-rhel8 (Red Hat 3scale API Management Platform 2) - Out of support scope
Pack
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-79771 rubygem-nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak [epel-all]
bugzilla·2026-08-27·CVSS 5.3
CVE-2026-79771 [MEDIUM] CVE-2026-79771 rubygem-nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak [epel-all]
CVE-2026-79771 rubygem-nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
Bugzilla
CVE-2026-79771 rubygem-nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak [fedora-all]
bugzilla·2026-08-27·CVSS 5.3
CVE-2026-79771 [MEDIUM] CVE-2026-79771 rubygem-nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak [fedora-all]
CVE-2026-79771 rubygem-nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
Bugzilla
CVE-2026-79771 nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak
bugzilla·2026-08-25·CVSS 5.3
CVE-2026-79771 [MEDIUM] CVE-2026-79771 nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak
CVE-2026-79771 nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
2026-08-25
Published