Out-of-Bounds Read Vulnerability in Nokogiri XML Library for Ruby
CVE-2026-57235

6.3MEDIUM

Key Information:

Vendor

Sparklemotion

Status
Nokogiri
Vendor
CVE Published:
25 June 2026

What is CVE-2026-57235?

Nokogiri, an open source library for parsing XML and HTML in Ruby, is affected by a vulnerability that allows out-of-bounds read due to improper index handling in the Nokogiri::XML::NodeSet#[] method. This occurs when a large negative index is applied, bypassing the bounds checks and leading to potential crashes in CRuby or incorrect results in JRuby. The issue has been resolved in version 1.19.4, emphasizing the importance of updating to safeguard applications.

Affected Version(s)

nokogiri < 1.19.4

References

https://github.com/sparklemotion/nokogiri/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.