Most recent entries from all

fkie_cve-2026-126062

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.

GHSA-v995-44v6-5fqm — JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host

Affected: RubyGems: nokogiri

### Summary

On JRuby, the `NONET` parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as `http://127.1/` or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a document parsed from a network URL. An application that parses untrusted XML with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests, potentially enabling SSRF.

Nokogiri 1.19.5 applies the `XML::Schema` check from [GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2): with `NONET` set, only local resources are loaded.

Only JRuby is affected. Default parse options are not affected.

### Severity

The Nokogiri maintainers have evaluated this as low severity.

### Mitigation

Upgrade to Nokogiri 1.19.5 or later, or do not enable `DTDLOAD`, `DTDVALID` or `NOENT` for untrusted input.

### Credit

This issue was responsibly reported by @arpitjain099.

UBUNTU-CVE-2026-126062

Affected: Ubuntu:Pro:14.04:LTS: ruby-nokogiri, Ubuntu:16.04:LTS: ruby-nokogiri, Ubuntu:18.04:LTS: ruby-nokogiri, Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri, Ubuntu:24.04:LTS: ruby-nokogiri, Ubuntu:26.10: ruby-nokogiri, Ubuntu:26.04:LTS: ruby-nokogiri