CVE-2026-57236 json
Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
published 2026-06-19 4 mo ago modified 2026-10-25 14 d ago also GHSA-5v8h-3h3q-446p , EUVD-2026-39419
- cvss
- 8.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.
Patch / fix
- rubygems nokogiri 1.19.4
- nokogiri nokogiri 1.19.4
- ruby-nokogiri Debian 14 1.19.4+dfsg-1
debian advisories DEBIAN-CVE-2026-57236
- openvox-agent satellite capsule 6.18, satellite capsule 6.17, satellite capsule 6.16 +3 more 8.24.1-3.el9sat
- openvox-server satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +5 more 8.14.1-1.el9sat
- rubygem-faraday satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +5 more 1.10.6-1.el9sat
- rubygem-katello satellite 6.18 4.18.0.15-1.el9sat
- python3.12-pyjwt satellite capsule 6.18, satellite 6.18 2.13.0-1.el9pc
- rubygem-nokogiri satellite capsule 6.18, satellite capsule 6.17, satellite 6.18 +1 more 1.15.7-3.el9sat
- python3.12-pillow satellite capsule 6.19, satellite capsule 6.18, satellite 6.19 +1 more 12.3.0-1.el9pc
- python3.12-pyjwt+crypto satellite capsule 6.18, satellite 6.18 2.13.0-1.el9pc
red hat advisories RHSA-2026:50263RHSA-2026:50222RHSA-2026:50223RHSA-2026:50221
- ruby-nokogiri Alpine 3.24 1.19.4-r0
alpine advisories ALPINE-CVE-2026-57236
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- rubygem-nokogiri Azure Linux 3.0 1.19.4-1
azure linux advisories AZL-91068
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-57236 updated cvss 6.5
nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling
-
Red Hat Satellite 6 rubygem-nokogiriaffected: workaround, no fix available
-
Red Hat Satellite 6.16 for RHEL 8 rubygem-nokogiri 1.15.7-3.el8sat Red Hat Satellite 6.16 for RHEL 9 rubygem-nokogiri 1.15.7-3.el9satfixed: vendor fix RHSA-2026:50223
-
Red Hat Satellite 6.17 for RHEL 9 rubygem-nokogiri 1.15.7-3.el9satfixed: vendor fix RHSA-2026:50222
-
Red Hat Satellite 6.18 for RHEL 9 rubygem-nokogiri 1.15.7-3.el9satfixed: vendor fix RHSA-2026:50263
-
Red Hat Satellite 6.19 for RHEL 9 rubygem-nokogiri 1.17.2-3.el9satfixed: vendor fix RHSA-2026:50221
-
Red Hat Satellite 6.16 for RHEL 8 libsolv 0.7.20-7.el8sat, satellite 6.16.12-1.el8sat, python-pyjwt 2.13.0-1.el8pc, python-pillow 12.3.0-1.el8pc, python3-solv 0.7.20-7.el8sat, openvox-agent 8.24.1-3.el8sat, +17 more Red Hat Satellite 6.16 for RHEL 9 satellite 6.16.12-1.el9sat, python-pyjwt 2.13.0-1.el9pc, python-pillow 12.3.0-1.el9pc, openvox-agent 8.24.1-3.el9sat, openvox-server 8.14.1-1.el9sat, satellite-cli 6.16.12-1.el9sat, +15 more Red Hat Satellite 6.17 for RHEL 9 satellite 6.17.10-1.el9sat, python-pyjwt 2.13.0-1.el9pc, python-pillow 12.3.0-1.el9pc, openvox-agent 8.24.1-3.el9sat, openvox-server 8.14.1-1.el9sat, satellite-cli 6.17.10-1.el9sat, +16 more Red Hat Satellite 6.18 for RHEL 9 satellite 6.18.8-1.el9sat, openvox-agent 8.24.1-3.el9sat, satellite-cli 6.18.8-1.el9sat, openvox-server 8.14.1-1.el9sat, python3.12-pyjwt 2.13.0-1.el9pc, rubygem-faraday 1.10.6-1.el9sat, +14 more Red Hat Satellite 6.19 for RHEL 9 foreman 3.18.0.8-1.el9sat, satellite 6.19.3-1.el9sat, foreman-cli 3.18.0.8-1.el9sat, foreman-ec2 3.18.0.8-1.el9sat, foreman-pcp 3.18.0.8-1.el9sat, satellite-cli 6.19.3-1.el9sat, +22 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 1.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U |
| CNA | 4.0 | 1.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | nokogiri | <1.19.4 |
1.19.4 |
Affected products
- sparklemotion nokogiri
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
github.com
/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p
web, mitigation, vendor-advisory
-
github.com
/sparklemotion/nokogiri
package
Sources
- CVE List CVE-2026-57236
- GitHub Advisory GHSA-5v8h-3h3q-446p
- NVD CVE-2026-57236
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.