Bug 2492963 (CVE-2026-57438)
| Summary: | CVE-2026-57438 nokogiri: rubygem-nokogiri: Nokogiri: Memory corruption due to XInclude substitution | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akostadi, amasferr, anthomas, crizzo, dmayorov, ehelms, eshamard, ggainey, jlledo, jpasqual, juwatts, jvasik, kaycoth, mhulan, nmoumoul, osousa, pantinor, pcreech, rblanco, rchan, rhel-process-autobot, smallamp, tmalecek, tsedmik, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Nokogiri, an XML and HTML library for the Ruby programming language. When performing XInclude substitutions, the library prematurely frees memory associated with nodes and namespaces. If an application has exposed these freed objects to Ruby, a local attacker could potentially trigger invalid reads or writes to memory. This memory corruption could lead to information disclosure or denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-06-25 16:01:16 UTC
|