Bug 2571274 (CVE-2026-126064)
| Summary: | CVE-2026-126064 nokogiri: nokogiri: Denial of Service via use-after-free when replacing attribute values | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | akostadi, amasferr, crizzo, dmayorov, eshamard, jlledo, jvasik, kaycoth, pantinor, rblanco, tsedmik |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Nokogiri. This vulnerability can lead to a Denial of Service (DoS) caused by an application crash. When an existing XML attribute value is replaced after its child nodes have been accessed, the library can retain references to memory that has already been freed. An attacker capable of triggering this specific sequence of operations can cause an invalid memory read, leading to an unexpected process termination.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-10 21:11:35 UTC
|