Read the docs
TI-2026-41174 Aliases CVE-2026-57236

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Priority LOW 10CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Partial nokogiri (sparklemotion): 1.19.4Red Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sparklemotionnokogiribefore 1.19.41.19.4Patch availableCNA
  • nokogiri Vendorsparklemotion Affected before 1.19.4 Fixed in 1.19.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*before 1.19.4Vulnerablesparklemotion
  • cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:* Versions before 1.19.4 Vulnerable ·sparklemotion

Remediation

  • Fix · CNA nokogiri (sparklemotion) Fixed in 1.19.4

Red Hat 4 advisories

  • RHSA-2026:50263 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.18.8 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python3.12-pillow-12.3.0-1.el9pc +5
  • RHSA-2026:50223 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.16.12 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 libsolv-1:0.7.20-7.el8sat, openvox-agent-8.24.1-3.el8sat, openvox-server-8.14.1-1.el8sat +9
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python-pillow-12.3.0-1.el9pc +7
  • RHSA-2026:50222 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.17.10 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python-pillow-12.3.0-1.el9pc +7
Show 1 more Red Hat advisories
  • RHSA-2026:50221 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.19.3 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-server-8.14.1-1.el9sat, python3.12-pillow-12.3.0-1.el9pc, rubygem-faraday-1.10.6-1.el9sat +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:50223
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:50223
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:50222
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:50263
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:50221
Not affected: 5 products
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57236

References

Advisory 1

  • TI-2022-11724 Improper Handling of Unexpected Data Type in Nokogiri CVSS 3.1HIGH 8.2
  • TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
  • TI-2019-03885 OS command injection in Nokogiri CVSS 3.1CRITICAL 9.8
  • TI-2026-55247 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer CVSS 4.0HIGH 8.7
  • TI-2022-07536 Unchecked return value from xmlTextReaderExpand in Nokogiri CVSS 3.1HIGH 7.5
  • TI-2022-08648 Inefficient Regular Expression Complexity in Nokogiri CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences