Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-25T14:30:20 nokogiri: Nokogiri: Server-Side Request Forgery (SSRF) and XML External Entity (XXE) via improper enforcement of NONET parse option 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N CWE-611

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

A flaw was found in Nokogiri, an XML and HTML library for Ruby. The NONET parse option, intended to prevent external resource fetching, was not correctly enforced in the JRuby implementation of Nokogiri::XML::Schema. This oversight could allow a specially crafted XML schema to fetch external resources over the network, potentially leading to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks.

Red Hat products are not affected by this vulnerability. This flaw is specific to the JRuby implementation of Nokogiri, where the NONET parse option was not correctly enforced on XML::Schema. Red Hat products use the CRuby (MRI) implementation, where NONET is correctly enforced and external resource fetching is properly blocked. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat 3scale API Management Platform 2 Not affected 3scale-amp21/backend Red Hat 3scale API Management Platform 2 Not affected 3scale-amp21/system Red Hat 3scale API Management Platform 2 Not affected 3scale-amp21/zync Red Hat 3scale API Management Platform 2 Not affected 3scale-amp22/backend Red Hat 3scale API Management Platform 2 Not affected 3scale-amp22/system Red Hat 3scale API Management Platform 2 Not affected 3scale-amp22/zync Red Hat 3scale API Management Platform 2 Not affected 3scale-amp26/toolbox Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/backend-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel7 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel9 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/toolbox-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/toolbox-rhel9 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/zync-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/zync-rhel9 Red Hat Satellite 6 Not affected rubygem-nokogiri Red Hat Satellite 6 Not affected satellite:el8/rubygem-nokogiri https://www.cve.org/CVERecord?id=CVE-2026-57234 https://nvd.nist.gov/vuln/detail/CVE-2026-57234 https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2