CVE-2026-126062
Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set
CVE-2026-126062 is a low vulnerability (CVSS 3.7) in Sparklemotion Nokogiri, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in nokogiri 1.19.5.
- Severity
- 3.7 LowCVSS 3.1, CVE List
- Exploit chance
- 0.38%EPSS, 32nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.19.5nokogiri +13 more
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nokogiriRubyGems | before 1.19.5 | 1.19.5 |
rubygem-nokogiriAzure Linux:3 | through 1.19.4-1 | None known |
ruby-nokogiriDebian:12 | All versions, plus listed versions 1.13.10+dfsg-21.14.2+dfsg-11.14.3+dfsg-11.14.3+dfsg-21.15.4+dfsg-1 Show 13 moreShow less1.16.0+dfsg-11.16.0+dfsg-21.16.2+dfsg-11.16.4+dfsg-11.17.2+dfsg-1~exp11.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
ruby-nokogiriDebian:13 | All versions, plus listed versions 1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
ruby-nokogiriDebian:14 | All versions, plus listed versions 1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
nokogiriRubyGems | before 1.19.5, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.0.51.0.61.0.71.1.01.1.11.10.01.10.0.rc11.10.11.10.101.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0.rc11.11.0.rc21.11.0.rc31.11.0.rc41.11.11.11.21.11.31.11.41.11.51.11.61.11.71.12.01.12.0.rc11.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.101.13.21.13.31.13.41.13.51.13.61.13.7 | 1.19.5 |
ruby-nokogiriUbuntu:Pro:14.04:LTS | All versions, plus listed versions 1.5.9-21.5.9-31.6.0-11.6.1+ds-11.6.1+ds-1ubuntu0.1~esm1 | None known |
ruby-nokogiriUbuntu:16.04:LTS | All versions, plus listed versions 1.6.6.2+ds-2build21.6.6.3-11.6.7-11.6.7.1-11.6.7.2-31.6.7.2-3build11.6.7.2-3ubuntu0.1 | None known |
ruby-nokogiriUbuntu:18.04:LTS | All versions, plus listed versions 1.8.0-11.8.1-11.8.1-1build11.8.2-1build11.8.2-1ubuntu0.1 | None known |
ruby-nokogiriUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1.10.3+dfsg1-21.10.4+dfsg1-11.10.7+dfsg1-11.10.7+dfsg1-21.10.7+dfsg1-2build11.10.7+dfsg1-2ubuntu0.1~esm2 | None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby-nokogiriUbuntu:Pro:22.04:LTS | All versions, plus listed versions 1.11.1+dfsg-2ubuntu11.11.7+dfsg-31.11.7+dfsg-3build11.13.1+dfsg-21.13.1+dfsg-2ubuntu0.1~esm1 | None known |
ruby-nokogiriUbuntu:24.04:LTS | All versions, plus listed versions 1.14.3+dfsg-21.16.2+dfsg-11.16.2+dfsg-1build1 | None known |
ruby-nokogiriUbuntu:26.10 | All versions, plus listed versions 1.18.10+dfsg-31.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1 | None known |
ruby-nokogiriUbuntu:26.04:LTS | All versions, plus listed versions 1.18.2+dfsg-1build11.18.10+dfsg-21.18.10+dfsg-3 | None known |
What each source reports
CVE List Score used
Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126062- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611, CWE-918
- Updated
- 2026-11-10
EUVDEUVD-2026-122828
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
- Record
EUVD-2026-122828- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-10
GitHub AdvisoriesGHSA-v995-44v6-5fqm
JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
Summary
On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF.
Nokogiri 1.19.5 applies the XML::Schema check from GHSA-8678-w3jw-xfc2: with NONET set, only local resources are loaded.
Only JRuby is affected. Default parse options are not affected.
Severity
The Nokogiri maintainers have evaluated this as low severity.
Mitigation
Upgrade to Nokogiri 1.19.5 or later, or do not enable DTDLOAD, DTDVALID or NOENT for untrusted input.
Credit
This issue was responsibly reported by @arpitjain099.
- Record
GHSA-v995-44v6-5fqm- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611, CWE-918
- Updated
- 2026-11-10
NVD
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126062- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611, CWE-918
- Updated
- 2026-11-10
OSV
Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126062- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611, CWE-918
- Updated
- 2026-11-12
OSVDEBIAN-CVE-2026-126062
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
- Record
DEBIAN-CVE-2026-126062- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-11
OSVGHSA-v995-44v6-5fqm
JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
Summary
On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF.
Nokogiri 1.19.5 applies the XML::Schema check from GHSA-8678-w3jw-xfc2: with NONET set, only local resources are loaded.
Only JRuby is affected. Default parse options are not affected.
Severity
The Nokogiri maintainers have evaluated this as low severity.
Mitigation
Upgrade to Nokogiri 1.19.5 or later, or do not enable DTDLOAD, DTDVALID or NOENT for untrusted input.
Credit
This issue was responsibly reported by @arpitjain099.
- Record
GHSA-v995-44v6-5fqm- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611, CWE-918
- Updated
- 2026-11-10
OSVUBUNTU-CVE-2026-126062
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
- Record
UBUNTU-CVE-2026-126062- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-13
OSVAZL-113335No score
CVE-2026-126062 affecting package rubygem-nokogiri 1.19.4-1
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
- Record
AZL-113335- Updated
- 2026-11-11
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| description, references, severity, title | CVE List, NVD | |
| aliases, products, published, references | EUVD | |
| affected, references | OSV | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-126062
security-tracker.debian.org/tracker/CVE-2026-126062
ubuntu.com/security/CVE-2026-126062
cve.org/CVERecord?id=CVE-2026-126062
Left out here: 145 versions. The JSON record has them.