CVE-2026-79771 — Nokogiri before 1.19.3 Memory Leak via XSLT Transform
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by p…
Published: 2026-08-25 · CVSS: 6.9 · CVSS 4.0
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7