CVE-2026-79772
published 2026-08-25CVE-2026-79772: Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.34%
26.4th percentile
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | backend-rhel8 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp2 | toolbox-rhel9 | — | — |
| 3scale-amp2 | zync-rhel9 | — | — |
| nokogiri | nokogiri | >= 1.5.1 < 1.19.1 | 1.19.1 |
| sparklemotion | nokogiri | >= 1.5.1 < 1.19.1 | 1.19.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nokogiri: Nokogiri: Signature validation bypass via unchecked return value
vendor_redhat·2026-08-25·CVSS 5.3
CVE-2026-79772 [MEDIUM] CWE-252 nokogiri: Nokogiri: Signature validation bypass via unchecked return value
nokogiri: Nokogiri: Signature validation bypass via unchecked return value
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
A flaw was found in Nokogiri. This vulnerability occurs because the `canonicalize` method fails to properly check the return value from an internal XML processing function, returning an empty string on failure instead of an error. A remote attacker could exploit this by providing specially crafted XML, leading to a bypass of signature validation in Security Assertion Markup
GHSA
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception.
ghsa_unreviewed·2026-08-25
CVE-2026-79772 [MEDIUM] CWE-252 Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception.
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-79772 rubygem-nokogiri: Nokogiri: Signature validation bypass via unchecked return value [epel-all]
bugzilla·2026-08-27·CVSS 5.3
CVE-2026-79772 [MEDIUM] CVE-2026-79772 rubygem-nokogiri: Nokogiri: Signature validation bypass via unchecked return value [epel-all]
CVE-2026-79772 rubygem-nokogiri: Nokogiri: Signature validation bypass via unchecked return value [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
Bugzilla
CVE-2026-79772 rubygem-nokogiri: Nokogiri: Signature validation bypass via unchecked return value [fedora-all]
bugzilla·2026-08-27·CVSS 5.3
CVE-2026-79772 [MEDIUM] CVE-2026-79772 rubygem-nokogiri: Nokogiri: Signature validation bypass via unchecked return value [fedora-all]
CVE-2026-79772 rubygem-nokogiri: Nokogiri: Signature validation bypass via unchecked return value [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
Bugzilla
CVE-2026-79772 nokogiri: Nokogiri: Signature validation bypass via unchecked return value
bugzilla·2026-08-25·CVSS 5.3
CVE-2026-79772 [MEDIUM] CVE-2026-79772 nokogiri: Nokogiri: Signature validation bypass via unchecked return value
CVE-2026-79772 nokogiri: Nokogiri: Signature validation bypass via unchecked return value
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
2026-08-25
Published