| Package | Affected versions | Patched versions |
|---|---|---|
| nokogiri | < 1.19.3 | 1.19.3 |
| nokogiri | < 1.19.3 | 1.19.3 |
Nokogiri's Nokogiri::XSLT::Stylesheet#transform leaks a small heap allocation when passed a Ruby string parameter containing a null byte.
For applications that pass attacker-controlled input through XSLT.transform parameters, this may be a vector for a denial of service attack against long-running processes.
Upgrade to Nokogiri >= 1.19.3.
Users may also be able to mitigate this issue without upgrading by validating untrusted transform parameters before passing them to Nokogiri::XSLT::Stylesheet#transform.
The Nokogiri maintainers have evaluated this as Moderate Severity, CVSS 5.3.
Each leaked allocation is approximately 24–32 bytes, so meaningful memory growth requires sustained attacker-controlled traffic at high call rates. The bug does not cause memory corruption, information disclosure, or any change in the behavior of the transform itself, and the string-handling exception is raised as expected.
Applications that do not pass raw attacker-controlled bytes to XSLT parameters are unlikely to be affected in practice.
This vulnerability was responsibly reported by @Captainjack-kor.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free