Medium severity5.3NVD Advisory· Published Aug 25, 2026· Updated Sep 1, 2026
CVE-2026-79771
CVE-2026-79771
Description
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nokogiriRubyGems | < 1.19.3 | 1.19.3 |
Affected products
29- Range: <1.19.3
- osv-coords28 versionspkg:apk/chainguard/gitlab-rails-ce-18.10pkg:apk/chainguard/gitlab-rails-ce-18.11pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/gitlab-rails-ce-fips-18.10pkg:apk/chainguard/gitlab-rails-ce-fips-18.11pkg:apk/chainguard/gitlab-rails-ce-fips-19.0pkg:apk/chainguard/pact-broker-dockerpkg:apk/chainguard/pact-broker-docker-fipspkg:apk/chainguard/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby3.2-rails-7.2pkg:apk/chainguard/ruby3.2-rails-8.0pkg:apk/chainguard/ruby3.2-rails-8.1pkg:apk/chainguard/ruby3.3-rails-7.2pkg:apk/chainguard/ruby3.3-rails-8.0pkg:apk/chainguard/ruby3.3-rails-8.1pkg:apk/chainguard/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby3.4-rails-7.2pkg:apk/chainguard/ruby3.4-rails-8.0pkg:apk/chainguard/ruby3.4-rails-8.1pkg:apk/chainguard/ruby4.0-rails-7.2pkg:apk/chainguard/ruby4.0-rails-8.0pkg:apk/chainguard/ruby4.0-rails-8.1pkg:apk/wolfi/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby3.2-rails-8.1pkg:apk/wolfi/ruby3.3-rails-8.1pkg:apk/wolfi/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby3.4-rails-8.1pkg:apk/wolfi/ruby4.0-rails-8.1
< 18.10.8-r0+ 27 more
- (no CPE)range: < 18.10.8-r0
- (no CPE)range: < 18.11.5-r0
- (no CPE)range: < 19.0.2-r0
- (no CPE)range: < 18.10.8-r0
- (no CPE)range: < 18.11.5-r0
- (no CPE)range: < 19.0.2-r0
- (no CPE)range: < 2.138.0.2.119.0-r1
- (no CPE)range: < 2.138.0.2.119.0-r1
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 7.2.3.1-r2
- (no CPE)range: < 8.0.5-r1
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 7.2.3.1-r3
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 7.2.3.1-r3
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 7.2.3.1-r3
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 8.1.3-r4
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-v2fc-qm4h-8hqvghsaADVISORY
- github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqvnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-79771ghsaADVISORY
- www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transformnvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.