Skip to content
OpenAdvisories
Low · 1.7 CVE-2026-57236 EUVD-2026-39419GHSA-5v8h-3h3q-446p

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Published Jun 25, 2026 · Updated Jun 25, 2026 · Assigned by GitHub_M

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.

Affected products

VendorProductAffectedFixed
sparklemotion nokogiri < 1.19.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ruby-nokogiri 1.19.4+dfsg-1 —
Debian 13 ruby-nokogiri No fix yet —
Debian 12 ruby-nokogiri No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 ruby-nokogiri No fix yet —
Ubuntu 26.04 LTS ruby-nokogiri No fix yet —
Ubuntu 25.10 ruby-nokogiri No fix yet —
Ubuntu 24.04 LTS ruby-nokogiri No fix yet —
Ubuntu 18.04 LTS ruby-nokogiri No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 22.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 20.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 14.04 LTS ruby-nokogiri No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 libsolv +1 1:0.7.20-7.el8sat RHSA-2026:50223
Red Hat Satellite Capsule 6 openvox-agent 8.24.1-3.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite Capsule 6 openvox-server 8.14.1-1.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite Capsule 6 python-pillow +1 12.3.0-1.el8pc RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite Capsule 6 python-pyjwt +2 2.13.0-1.el8pc RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite Capsule 6 python3.12-pillow 12.3.0-1.el9pc RHSA-2026:50263, RHSA-2026:50221
Red Hat Satellite Capsule 6 python3.12-pyjwt +1 2.13.0-1.el9pc RHSA-2026:50263
Red Hat Satellite Capsule 6 rubygem-faraday 1.10.6-1.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite Capsule 6 rubygem-nokogiri 1.15.7-3.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite 6 libsolv +1 1:0.7.20-7.el8sat RHSA-2026:50223
Red Hat Satellite 6 openvox-agent 8.24.1-3.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite 6 openvox-server 8.14.1-1.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite 6 python-pillow +1 12.3.0-1.el8pc RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite 6 python-pyjwt +2 2.13.0-1.el8pc RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite 6 python3.12-pillow 12.3.0-1.el9pc RHSA-2026:50263, RHSA-2026:50221
Red Hat Satellite 6 python3.12-pyjwt +1 2.13.0-1.el9pc RHSA-2026:50263
Red Hat Satellite 6 rubygem-faraday 1.10.6-1.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite 6 rubygem-katello 4.14.0.21-1.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
Red Hat Satellite 6 rubygem-nokogiri 1.15.7-3.el8sat RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222
ReleasePackageFixed inAdvisory
Alpine v3.24 ruby-nokogiri 1.19.4-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 rubygem-nokogiri 1.19.4-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems nokogiri < 1.19.4 1.19.4 GHSA-5v8h-3h3q-446p

Advisories 4

References