CVE-2026-126064
— UNSCOREDpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
Weaknesses
CWE-416
Public exploit & PoC references
- https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425
- https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f
- https://github.com/sparklemotion/nokogiri/pull/3752
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w
All references
- https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425
- https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f
- https://github.com/sparklemotion/nokogiri/pull/3752
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-55654PoC
- MEDIUMCVE-2025-60476PoC
- MEDIUMCVE-2025-60478PoC
- MEDIUMCVE-2025-60491PoC
- CRITICALCVE-2026-0163
- HIGHCVE-2026-100200
- CRITICALCVE-2026-100202
- HIGHCVE-2026-100204
Related by shared AI tags and CWE weakness class. Browse the full archive.