CVE-2026-126062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126062", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.283Z", "datePublished": "2026-11-10T20:11:46.316Z", "dateUpdated": "2026-11-12T18:01:54.547Z"}, "containers": {"cna": {"title": "Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set", "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "lang": "en", "description": "CWE-611: Improper Restriction of XML External Entity Reference", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"}, {"name": "https://github.com/sparklemotion/nokogiri/pull/3752", "tags": ["x_refsource_MISC"], "url": "https://github.com/sparklemotion/nokogiri/pull/3752"}, {"name": "https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8", "tags": ["x_refsource_MISC"], "url": "https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"}, {"name": "https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac", "tags": ["x_refsource_MISC"], "url": "https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"}, {"name": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}], "affected": [{"vendor": "sparklemotion", "product": "nokogiri", "versions": [{"version": "< 1.19.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:11:46.316Z"}, "descriptions": [{"lang": "en", "value": "Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5."}], "source": {"advisory": "GHSA-v995-44v6-5fqm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T16:26:21.600157Z", "id": "CVE-2026-126062", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T18:01:54.547Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "nokogiri", "vendor": "sparklemotion", "versions": [{"status": "affected", "version": "< 1.19.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5."}], "id": "CVE-2026-126062", "lastModified": "2026-11-12T22:09:39.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126062", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T16:26:21.600157Z", "version": "2.0.3"}}]}, "published": "2026-11-10T20:19:10.030", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"}, {"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"}, {"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/pull/3752"}, {"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nokogiri: nokogiri: Server-Side Request Forgery via network restriction bypass on JRuby", "id": "2570848", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570848"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-611", "details": ["A flaw was found in Nokogiri. When running on JRuby, the library fails to properly enforce network restrictions during the resolution of external Document Type Definitions (DTDs) or entities. A remote attacker can exploit this issue by supplying a crafted XML document containing short-form network addresses or specific paths to cause Server-Side Request Forgery (SSRF). This vulnerability allows the attacker to induce the server to make unauthorized network requests, potentially exposing internal services or sensitive data."], "mitigation": {"lang": "en:us", "value": "Avoid enabling DTD loading, validation, or entity substitution options (such as DTDLOAD, DTDVALID, or NOENT) when parsing untrusted XML documents within JRuby applications, ensuring default parsing configurations remain in place. In environments where untrusted XML processing must occur, implement network egress filtering to restrict outbound network connections initiated by the application runtime.\nCaveat: Disabling DTD processing or external entity expansion may break XML parsing in applications that depend on external schemas or entity resolution. If application code or firewall rules are modified, restarting the affected service may be required for changes to take effect."}, "name": "CVE-2026-126062", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/backend-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/toolbox-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}], "public_date": "2026-11-10T20:11:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126062\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126062\nhttps://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8\nhttps://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac\nhttps://github.com/sparklemotion/nokogiri/pull/3752\nhttps://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5\nhttps://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"], "statement": "Red Hat Product Security has rated this vulnerability as having a Low severity because typical Red Hat environments deploy CRuby, which is entirely unaffected by this flaw. The bypass only manifests when running on the JRuby runtime and specifically parsing untrusted XML with optional, non-default flags such as DTD validation, DTD loading, or entity substitution. Default parsing configurations remain safe from this network restriction bypass, significantly restricting the scope of potential server-side request forgery.", "threat_severity": "Low"}

{"created": "2026-11-12T02:00:13.876204+00:00", "updated": "2026-11-12T16:00:04.994286+00:00", "vendors": []}