CVE-2026-126064

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126064", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.283Z", "datePublished": "2026-11-10T20:17:13.658Z", "dateUpdated": "2026-11-10T20:57:32.805Z"}, "containers": {"cna": {"title": "Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w"}, {"name": "https://github.com/sparklemotion/nokogiri/pull/3752", "tags": ["x_refsource_MISC"], "url": "https://github.com/sparklemotion/nokogiri/pull/3752"}, {"name": "https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425", "tags": ["x_refsource_MISC"], "url": "https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425"}, {"name": "https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f", "tags": ["x_refsource_MISC"], "url": "https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f"}, {"name": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}], "affected": [{"vendor": "sparklemotion", "product": "nokogiri", "versions": [{"version": "< 1.19.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:17:13.658Z"}, "descriptions": [{"lang": "en", "value": "Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5."}], "source": {"advisory": "GHSA-3w22-6jfg-527w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T20:57:22.881835Z", "id": "CVE-2026-126064", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T20:57:32.805Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-126064", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T20:57:22.881835Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T20:57:28.491Z"}}], "cna": {"title": "Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`", "source": {"advisory": "GHSA-3w22-6jfg-527w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "sparklemotion", "product": "nokogiri", "versions": [{"status": "affected", "version": "< 1.19.5"}]}], "references": [{"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w", "name": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sparklemotion/nokogiri/pull/3752", "name": "https://github.com/sparklemotion/nokogiri/pull/3752", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425", "name": "https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f", "name": "https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5", "name": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:17:13.658Z"}}}, "cveMetadata": {"cveId": "CVE-2026-126064", "state": "PUBLISHED", "dateUpdated": "2026-11-10T20:57:32.805Z", "dateReserved": "2026-11-10T17:07:43.283Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-10T20:17:13.658Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nokogiri", "vendor": "sparklemotion", "versions": [{"status": "affected", "version": "< 1.19.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5."}], "id": "CVE-2026-126064", "lastModified": "2026-11-12T22:18:35.610", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126064", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T20:57:22.881835Z", "version": "2.0.3"}}]}, "published": "2026-11-10T21:19:24.147", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425"}, {"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f"}, {"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/pull/3752"}, {"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "nokogiri: nokogiri: Denial of Service via use-after-free when replacing attribute values", "id": "2571274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571274"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in Nokogiri. This vulnerability can lead to a Denial of Service (DoS) caused by an application crash. When an existing XML attribute value is replaced after its child nodes have been accessed, the library can retain references to memory that has already been freed. An attacker capable of triggering this specific sequence of operations can cause an invalid memory read, leading to an unexpected process termination."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-126064", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/backend-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/toolbox-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}], "public_date": "2026-11-10T20:17:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126064\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126064\nhttps://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425\nhttps://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f\nhttps://github.com/sparklemotion/nokogiri/pull/3752\nhttps://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5\nhttps://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w"], "statement": "This vulnerability is rated as having a Low severity impact because triggering the underlying memory corruption requires highly specific and unusual API interaction patterns within calling Ruby applications. Standard document processing in Red Hat environments does not retain references to attribute child objects while modifying attribute values. Consequently, the blast radius is restricted to local denial of service via a process termination, with no risk to data integrity or confidentiality.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nokogiri", "source": "cna", "vendor": "sparklemotion"}, "product": "nokogiri", "vendor": "sparklemotion"}], "created": "2026-11-12T01:00:09.865062+00:00", "updated": "2026-11-13T11:45:20.064021+00:00", "vendors": ["sparklemotion", "sparklemotion$PRODUCT$nokogiri"]}