CVE-2026-79771 in Nokogiri
Summary
by MITRE • 08/25/2026
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Nokogiri versions prior to 1.19.3 represents a significant memory management flaw within the XSLT stylesheet transformation engine. This issue specifically arises when the transform method is invoked with Ruby strings that contain null bytes, which are typically used as string terminators in C-based libraries but can cause parsing inconsistencies if not handled correctly by the surrounding application logic. Nokogiri relies on libxml2 for its XML and HTML processing capabilities, including XSLT transformations. When a user-supplied input containing embedded null characters is passed to the transform function, the underlying C code fails to properly manage memory allocation during the traversal of the stylesheet or result tree. This failure results in heap allocations that are not subsequently freed, leading to a progressive accumulation of unreleased memory blocks within the process address space.
From an operational perspective, this flaw enables a denial of service attack against applications utilizing Nokogiri for long-running processes such as web servers, background job processors, or API gateways. As an attacker repeatedly submits requests containing crafted payloads with null bytes, the application's memory consumption increases steadily without bound. This uncontrolled growth eventually exhausts available system resources, causing the process to crash due to out-of-memory conditions or triggering automatic termination by container orchestration systems like Kubernetes. The impact is particularly severe in environments where Nokogiri processes high volumes of user-generated content, as even small amounts of leaked memory per request can accumulate rapidly under load, degrading service availability for legitimate users and potentially causing data loss if the process crashes during critical transactions.
This vulnerability aligns with CWE-401, which describes a missing release of memory after effective usage, often referred to as a memory leak. The exploitation vector involves providing attacker-controlled input that triggers improper resource management within a library function, mapping closely to CWE-789 in the context of uncontrolled resource consumption leading to denial of service. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1496, Resource Hijacking, where an attacker consumes resources to degrade or disrupt services rather than stealing data directly. The lack of proper boundary checking and memory deallocation for strings containing null bytes highlights a gap in the input validation and lifecycle management routines within the affected Nokogiri versions.
To mitigate this vulnerability, organizations must upgrade Nokogiri to version 1.19.3 or later, where the issue has been resolved by ensuring that all heap allocations associated with XSLT transformations are properly released regardless of whether the input string contains null bytes. Developers should also implement strict input validation at the application layer before passing data to Nokogiri functions, filtering out or sanitizing strings that contain unexpected control characters if such inputs are not required for business logic. Additionally, monitoring memory usage trends in production environments can help detect anomalous growth patterns indicative of this leak, allowing for proactive intervention before a full denial of service occurs. Regular dependency audits and patch management procedures are essential to maintain the integrity and availability of systems relying on Nokogiri for XML processing tasks.