{"id":"CVE-2026-126062","aliases":["AZL-113335","DEBIAN-CVE-2026-126062","EUVD-2026-122828","GHSA-v995-44v6-5fqm","UBUNTU-CVE-2026-126062"],"status":"published","title":"Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.0038,"percentile":0.3252,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611","CWE-918"],"published":"2026-11-10T20:11:46Z","modified":"2026-11-12T23:46:37Z","fixes":[{"ecosystem":"RubyGems","package":"nokogiri","fixed_in":["1.19.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.19.4-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.10+dfsg-2","1.14.2+dfsg-1","1.14.3+dfsg-1","1.14.3+dfsg-2","1.15.4+dfsg-1","1.16.0+dfsg-1","1.16.0+dfsg-2","1.16.2+dfsg-1","1.16.4+dfsg-1","1.17.2+dfsg-1~exp1","1.18.10+dfsg-1","1.18.10+dfsg-2","1.18.10+dfsg-3","1.18.2+dfsg-1","1.19.1+dfsg-1","1.19.3+dfsg-1","1.19.4+dfsg-1","1.19.7+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.10+dfsg-1","1.18.10+dfsg-2","1.18.10+dfsg-3","1.18.2+dfsg-1","1.19.1+dfsg-1","1.19.3+dfsg-1","1.19.4+dfsg-1","1.19.7+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.10+dfsg-1","1.18.10+dfsg-2","1.18.10+dfsg-3","1.18.2+dfsg-1","1.19.1+dfsg-1","1.19.3+dfsg-1","1.19.4+dfsg-1","1.19.7+dfsg-1"]},{"source":"osv","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.10.0","1.10.0.rc1","1.10.1","1.10.10","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.0.rc1","1.11.0.rc2","1.11.0.rc3","1.11.0.rc4","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.0.rc1","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.16.7","1.16.8","1.17.0","1.17.1","1.17.2","1.18.0","1.18.0.rc1","1.18.1","1.18.10","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.18.9","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0.rc1","1.9.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.9-2","1.5.9-3","1.6.0-1","1.6.1+ds-1","1.6.1+ds-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.6.2+ds-2build2","1.6.6.3-1","1.6.7-1","1.6.7.1-1","1.6.7.2-3","1.6.7.2-3build1","1.6.7.2-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.1-1","1.8.1-1build1","1.8.2-1build1","1.8.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.3+dfsg1-2","1.10.4+dfsg1-1","1.10.7+dfsg1-1","1.10.7+dfsg1-2","1.10.7+dfsg1-2build1","1.10.7+dfsg1-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.1+dfsg-2ubuntu1","1.11.7+dfsg-3","1.11.7+dfsg-3build1","1.13.1+dfsg-2","1.13.1+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.3+dfsg-2","1.16.2+dfsg-1","1.16.2+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.10+dfsg-3","1.19.1+dfsg-1","1.19.3+dfsg-1","1.19.4+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.2+dfsg-1build1","1.18.10+dfsg-2","1.18.10+dfsg-3"]}],"products":[{"vendor":"sparklemotion","product":"nokogiri"}],"references":[{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/sparklemotion/nokogiri/pull/3752","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-v995-44v6-5fqm.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v995-44v6-5fqm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126062","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126062.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-126062","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-126062","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-126062","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-126062","title":"Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","status":"published","published":"2026-11-10T20:11:46.316Z","modified":"2026-11-12T18:01:54.547Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-611","CWE-918"],"updated_at":"2026-11-10T22:18:27.383863Z"}],"euvd":[{"id":"EUVD-2026-122828","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","status":"published","published":"2026-11-10T20:11:46Z","modified":"2026-11-12T18:01:54Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-10T23:24:33.201322Z"}],"ghsa":[{"id":"GHSA-v995-44v6-5fqm","title":"JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host","description":"### Summary\n\nOn JRuby, the `NONET` parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as `http://127.1/` or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a document parsed from a network URL. An application that parses untrusted XML with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests, potentially enabling SSRF.\n\nNokogiri 1.19.5 applies the `XML::Schema` check from [GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2): with `NONET` set, only local resources are loaded.\n\nOnly JRuby is affected. Default parse options are not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later, or do not enable `DTDLOAD`, `DTDVALID` or `NOENT` for untrusted input.\n\n### Credit\n\nThis issue was responsibly reported by @arpitjain099.","status":"published","published":"2026-11-10T20:52:38Z","modified":"2026-11-10T20:52:39Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-611","CWE-918"],"updated_at":"2026-11-10T20:57:14.224476Z"}],"nvd":[{"id":"CVE-2026-126062","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","status":"published","published":"2026-11-10T20:19:10.03Z","modified":"2026-11-12T22:09:39.233Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-611","CWE-918"],"updated_at":"2026-11-10T22:21:33.755054Z"}],"osv":[{"id":"CVE-2026-126062","title":"Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","status":"published","published":"2026-11-10T20:11:46.316Z","modified":"2026-11-13T13:10:10.297229758Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-611","CWE-918"],"updated_at":"2026-11-12T03:30:55.144331Z"},{"id":"DEBIAN-CVE-2026-126062","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","status":"published","published":"2026-11-10T20:19:10.03Z","modified":"2026-11-13T09:47:32.898637047Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-11T11:06:10.823198Z"},{"id":"GHSA-v995-44v6-5fqm","title":"JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host","description":"### Summary\n\nOn JRuby, the `NONET` parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as `http://127.1/` or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a document parsed from a network URL. An application that parses untrusted XML with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests, potentially enabling SSRF.\n\nNokogiri 1.19.5 applies the `XML::Schema` check from [GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2): with `NONET` set, only local resources are loaded.\n\nOnly JRuby is affected. Default parse options are not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later, or do not enable `DTDLOAD`, `DTDVALID` or `NOENT` for untrusted input.\n\n### Credit\n\nThis issue was responsibly reported by @arpitjain099.","status":"published","published":"2026-11-10T20:52:38Z","modified":"2026-11-10T21:00:04.025096383Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-611","CWE-918"],"updated_at":"2026-11-10T21:13:26.339973Z"},{"id":"UBUNTU-CVE-2026-126062","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","status":"published","published":"2026-11-12T00:00:00Z","modified":"2026-11-13T21:05:31.907419085Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-13T21:30:20.292037Z"},{"id":"AZL-113335","title":"CVE-2026-126062 affecting package rubygem-nokogiri 1.19.4-1","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","status":"published","published":"2026-11-10T20:19:10Z","modified":"2026-11-11T14:17:33.233923266Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}