Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T14:39:23 nokogiri: rubygem-nokogiri: Nokogiri: Memory corruption due to XInclude substitution 6.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H CWE-825

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.

A flaw was found in Nokogiri, an XML and HTML library for the Ruby programming language. When performing XInclude substitutions, the library prematurely frees memory associated with nodes and namespaces. If an application has exposed these freed objects to Ruby, a local attacker could potentially trigger invalid reads or writes to memory. This memory corruption could lead to information disclosure or denial of service.

A flaw was found in Nokogiri, an XML and HTML library for the Ruby programming language. When performing XInclude substitution via Nokogiri::XML::Node#do_xinclude, the library frees memory associated with replaced xi:include nodes, their children (including xi:fallback), and declared namespaces. If an application has already exposed one of these nodes or namespaces to Ruby, the corresponding Ruby object points to freed memory, which could result in invalid memory reads or writes. Red Hat products ship Nokogiri as a dependency of several components. The impact on Red Hat products is rated Moderate because exploitation requires the application to both perform XInclude substitution and separately retain references to nodes or namespaces within the substituted elements — a combination that is uncommon in typical usage patterns. This vulnerability only affects CRuby; JRuby is not affected. This issue is fixed in Nokogiri version 1.19.4. Upgrade to Nokogiri 1.19.4 or later. As a workaround for earlier versions, perform XInclude substitution at parse time (with the xinclude parse option) rather than calling #do_xinclude on a document that has already been traversed. A freshly parsed document has no nodes exposed to Ruby, so the substitution is safe. Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp21/backend Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp21/system Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp21/zync Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp22/backend Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp22/system Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp22/zync Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp26/toolbox Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/backend-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel7 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel9 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/toolbox-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/toolbox-rhel9 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/zync-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/zync-rhel9 Red Hat Satellite 6 Fix deferred rubygem-nokogiri Red Hat Satellite 6 Fix deferred satellite:el8/rubygem-nokogiri https://www.cve.org/CVERecord?id=CVE-2026-57438 https://nvd.nist.gov/vuln/detail/CVE-2026-57438 https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wfpw-mmfh-qq69