CVE-2026-126062
Description
A flaw was found in Nokogiri. When running on JRuby, the library fails to properly enforce network restrictions during the resolution of external Document Type Definitions (DTDs) or entities. A remote attacker can exploit this issue by supplying a crafted XML document containing short-form network addresses or specific paths to cause Server-Side Request Forgery (SSRF). This vulnerability allows the attacker to induce the server to make unauthorized network requests, potentially exposing internal services or sensitive data.
Statement
Red Hat Product Security has rated this vulnerability as having a Low severity because typical Red Hat environments deploy CRuby, which is entirely unaffected by this flaw. The bypass only manifests when running on the JRuby runtime and specifically parsing untrusted XML with optional, non-default flags such as DTD validation, DTD loading, or entity substitution. Default parsing configurations remain safe from this network restriction bypass, significantly restricting the scope of potential server-side request forgery.
Mitigation
Avoid enabling DTD loading, validation, or entity substitution options (such as DTDLOAD, DTDVALID, or NOENT) when parsing untrusted XML documents within JRuby applications, ensuring default parsing configurations remain in place. In environments where untrusted XML processing must occur, implement network egress filtering to restrict outbound network connections initiated by the application runtime.
Caveat: Disabling DTD processing or external entity expansion may break XML parsing in applications that depend on external schemas or entity resolution. If application code or firewall rules are modified, restarting the affected service may be required for changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system. By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g., in an error message), thereby exposing the file contents.
Integrity
Technical Impact: Bypass Protection Mechanism
An attacker may supply a crafted DTD using URIs with schemes such as http://, forcing the application to make outgoing HTTP requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions; hide the source of attacks such as port scanning; or otherwise leverage the server's trust relationship with other entities.
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
The product could consume excessive CPU cycles or memory using a URI that points to a large file, or a device that always returns data such as /dev/random. Alternately, the URI could reference a file that contains many nested or recursive entity references to further slow down parsing.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
