CVE-2026-79770
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Aug 25, 2026
CISA due date
—
The record
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-80206 NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability… CWE-1333
- CVE-2026-80205 NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability… CWE-1333
- CVE-2026-72818 The URLS regular expression in nltk/tokenize/casual.py, compiled into… CWE-1333
- CVE-2026-59893 sqlparse is a non-validating SQL parser module for Python. CWE-1333
- CVE-2026-54284 sqlparse is a non-validating SQL parser module for Python. CWE-1333
- CVE-2026-69207 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-1333
- CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex… CWE-1333
- CVE-2026-49477 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. CWE-1333