Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-25T15:16:03 nokogiri: Nokogiri: Denial of Service via XSLT transform memory leak 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-770

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

A flaw was found in Nokogiri. Attackers can exploit a memory leak in the XSLT Stylesheet transform method by providing specially crafted input containing null bytes. This can lead to excessive memory consumption and enable a denial of service against long-running processes.

Red Hat 3scale API Management Platform 2 Out of support scope 3scale-amp2/backend-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel9 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/toolbox-rhel9 Red Hat 3scale API Management Platform 2 Out of support scope 3scale-amp2/zync-rhel9 Red Hat Satellite 6 Fix deferred tfm-rubygem-amazing_print Red Hat Satellite 6 Fix deferred tfm-rubygem-graphql https://www.cve.org/CVERecord?id=CVE-2026-79771 https://nvd.nist.gov/vuln/detail/CVE-2026-79771 https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv https://www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transform