Approved changes feed: RSS · Atom
cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sparklemotion (9afae122-2fa2-5d57-8112-a64227088e04) |
|---|---|
| Product | Nokogiri (21a6d0e1-9072-54b0-8086-e4a9f72fd03a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-57438 |
vulnerable | 2026-07-29 01:00:29.811086 |
Nokogiri: Possible Use-After-Free in XInclude Processing
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.
Published: 2026-06-25T14:39:23.239Z
Updated: 2026-06-25T16:23:43.395Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57437 |
vulnerable | 2026-07-29 01:00:29.810969 |
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.
Published: 2026-06-25T14:34:09.482Z
Updated: 2026-06-25T15:00:01.455Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57436 |
vulnerable | 2026-07-29 01:00:29.810851 |
Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.
Published: 2026-06-25T14:33:29.496Z
Updated: 2026-06-25T23:27:34.410Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57435 |
vulnerable | 2026-07-29 01:00:29.810621 |
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.
Published: 2026-06-25T14:32:49.306Z
Updated: 2026-06-25T14:53:19.607Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57434 |
vulnerable | 2026-07-29 01:00:29.810373 |
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.
Published: 2026-06-25T14:32:10.604Z
Updated: 2026-06-25T15:48:24.125Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57236 |
vulnerable | 2026-07-29 01:00:29.504896 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57235 |
vulnerable | 2026-07-29 01:00:29.504672 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57234 |
vulnerable | 2026-07-29 01:00:29.504353 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6494 |
vulnerable | 2026-06-08 07:43:15.163618 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6490 |
vulnerable | 2026-06-08 07:43:15.151525 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29181 |
vulnerable | 2026-06-08 05:42:47.286052 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24836 |
vulnerable | 2026-06-08 05:41:44.725331 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23476 |
vulnerable | 2026-06-08 05:40:57.608723 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41098 |
vulnerable | 2026-06-08 05:35:19.733264 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-26247 |
vulnerable | 2026-06-08 05:23:50.958645 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.