MEDIUMCVSS 5.5Vulnerability
CVE-2026-79769
Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.
Properties
- severity
- MEDIUM
- cvss_severity
- MEDIUM
- cvss_score
- 5.5
- retrieved_at
- 2026-09-25T15:10:03+00:00
- score
- 5.5
- last_source
- NVD
- cve_id
- CVE-2026-79769
- cvss_vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- signal_observed_at
- 2026-09-25T15:10:03+00:00
- vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- published_at
- 2026-08-25T16:17:28.320
- last_modified
- 2026-09-24T20:43:32.537
Related Entities (2)
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]Access of Resource Using Incompatible Type ('Type Confusion')
Explore deeper with Ninja Signal's threat intelligence graph