CVE-2026-79771: nokogiri
CVSS: 6.9v4.0MediumAnalyzed
AliasesUBUNTU-CVE-2026-79771DEBIAN-CVE-2026-79771CGA-4r5f-2fcf-xxq7CGA-75j4-jrcg-8qm5CGA-7gr4-hr3p-g6q5CGA-7m22-xpjq-3hvrCGA-8728-4mhp-pv72CGA-947g-8jv6-g7qwCGA-9mpx-cq3q-rm2fCGA-c7jv-qx24-f43wCGA-f7jx-m49r-hgf2CGA-fhww-wp5w-6ff8CGA-gh2w-rvcv-q5wcCGA-gh6m-xmm6-3j7wCGA-j39q-8885-2jgmCGA-p284-gq48-qhh8CGA-p6f5-6rfc-q9p9CGA-pcq3-qw2m-h9fxCGA-pqrq-477g-796hCGA-v379-jf88-7pp3CGA-24x6-9qhr-mhm6CGA-26fp-7vj5-9q59CGA-26v8-52g8-wj6hCGA-2gf6-pg7h-fg3qCGA-2m2p-mvhf-gqgqCGA-2rh6-gmm9-8v7cCGA-2x9g-5f2x-x8q2CGA-3238-2m3c-jvgrCGA-338c-8732-8vc3CGA-37g4-3p9w-hcccCGA-3fmx-pg33-225jCGA-3x4v-mmq9-5w2qCGA-424g-9vpp-gcqjCGA-46c2-h2c9-h2gpCGA-486m-prvr-7f4vCGA-4cgf-fvp5-3vrfCGA-4p3q-2ph8-4fhqCGA-4q9g-qg9h-v6g6CGA-5m3w-gmrj-q7wwCGA-5v65-966g-x7pjCGA-5w26-m37x-9g9pCGA-67gp-grvf-jrpxCGA-68g8-jq69-q59fCGA-6r8w-hjmc-699xCGA-6vjv-28mv-4c4rCGA-6wj6-4qf5-fwxvCGA-75m7-8wr5-5422CGA-7876-9fxg-69crCGA-7q95-9xfx-jx45CGA-83c3-2fw4-pvm4CGA-8j33-xwhh-944hCGA-8jp5-r45c-52r5CGA-926p-734p-9h49CGA-93pw-5f4f-q3wwCGA-c3h3-4v8j-v5pxCGA-c65r-gp3p-55c9CGA-cqgv-vv87-h664CGA-cwjh-9734-7hh2CGA-fv48-cgvc-whxgCGA-fxc5-9hc6-rvg6CGA-g8pc-48x9-9p66CGA-g992-j5fx-jcj7CGA-gj68-6mgr-w6p5CGA-gj9f-rcw6-pvgmCGA-gpfg-5f75-p53wCGA-gpxm-3gvc-mqj2CGA-h663-33v2-hqcwCGA-hg8x-9377-jgqvCGA-hwfv-rcvm-qp59CGA-j28w-v7jr-v37qCGA-j84h-x9f3-3q98CGA-j98x-h83w-qwr3CGA-jm2v-7h62-326hCGA-jv3r-pgw8-9g8jCGA-jx5c-c929-7hfgCGA-m52w-p48m-899qCGA-m8fv-2pqh-x568CGA-mg9h-5qmf-5r9cCGA-mjph-rxcm-h3v6CGA-mwf9-p8jv-77rvCGA-mxgq-xcwj-rv99CGA-p3qh-v8vq-722vCGA-p66f-fq7j-fwg6CGA-pvq4-jm7c-qpv4GHSA-v2fc-qm4h-8hqvCGA-q4r4-988q-434qCGA-q578-6459-x337CGA-q5qq-jj36-f7rpCGA-q87f-r46w-px32CGA-qj98-66w2-37cmCGA-qwc2-jh7c-qwf2CGA-qx7v-2jxw-65xpCGA-r5gw-h8m6-pmp7CGA-r936-h9vg-jxhhCGA-rj3x-3p78-w7gcCGA-rjcx-2pmq-893pCGA-rjwr-4gg7-99h6CGA-v469-83qh-5pcpCGA-vq49-mmh2-h272CGA-vqj8-79r6-29rmCGA-vrfv-x7f6-cx67CGA-w3r4-7rfm-fxqjCGA-w4mv-c2mf-gfgmCGA-w869-3phr-p2mcCGA-wghx-mvhq-6pqhCGA-wphg-7r5v-8922CGA-wr5p-qrx9-v47qCGA-wrc4-m667-84w6CGA-wvx5-rp5q-4pfmCGA-x39p-v2cw-73v8CGA-xcmg-fw3m-878jCGA-xg2w-rf56-rpj7CGA-xrpv-rgf6-95qxCGA-xvp5-gp25-w8r4CGA-xw56-9j4w-2mr9
Published 25-08-2026Last modified 25-08-2026
Vulnerability summary
CVE-2026-79771 is a medium (CVSS 6.9) vulnerability in nokogiri. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.4% of scored vulnerabilities.
CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)EPSS score
0.42%
0%100%
Low · +0.12 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 1 · Downstream 0 · Related 1Timeline
- 25-08-2026PublishedVulnerability first disclosed.
- 25-08-2026Last modifiedVulnerability information updated.
Description
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
CVSS metrics
10 scores · 7 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · RubygemsEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.12 pp
From 0.30% on 21-09-2026
21-09-202621-10-2026
EPSS score0.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard56 products
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10< 18.10.8-r0
- gitlab-rails-ce-18.11< 18.11.5-r0
- gitlab-rails-ce-18.3All versions (No fix recorded)
- gitlab-rails-ce-18.4All versions (No fix recorded)
Wolfi9 products
- logstash-9.3All versions (No fix recorded)
- logstash-9.3-iamguarded-compatAll versions (No fix recorded)
- logstash-9.3-with-output-opensearchAll versions (No fix recorded)
- ruby3.2-kube-logging-operator-fluentd-outputs< 6.5.0-r2
- ruby3.2-rails-8.1< 8.1.3-r3
Debian1 product
- ruby-nokogiriAll versions (No fix recorded) | < 1.19.3+dfsg-1
Nokogiri1 product
- nokogiri< 1.19.3
RubyGems1 product
- nokogiri< 1.19.3
Sparklemotion1 product
- nokogiri< 1.19.3
Ubuntu1 product
- ruby-nokogiriAll versions (No fix recorded)
7 vendors · 70 products
References
8 links- github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqvVendor AdvisoryREPORTAdvisoryWEB
- www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transformThird Party AdvisoryAdvisoryWEB
