CVE-2026-79771
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Aug 25, 2026
CISA due date
—
The record
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-18313 rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or… CWE-401
- CVE-2026-56818 Netty is an asynchronous, event-driven network application framework. CWE-401
- CVE-2026-54876 Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has… CWE-401
- CVE-2026-51400 An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute… CWE-401
- CVE-2026-66011 ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick… CWE-401
- CVE-2026-64292 In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent… CWE-401
- CVE-2026-56819 Netty is a network application framework for development of protocol servers and clients. CWE-401
- CVE-2026-53396 In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl… CWE-401