CVE-2026-57236

HighCVSS 8.2/10Last modified Jun 26, 2026

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-572377.8When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects refere CVE-2026-572387.8After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, whi CVE-2026-572397.8The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the oppor CVE-2026-57246.3The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are CVE-2026-572407.8When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulti CVE-2026-572416.1The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the CVE-2026-572427.8The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management CVE-2026-572436.1During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, wi CVE-2026-572447.8After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in t CVE-2026-572457.8When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal anno CVE-2026-572467.8When dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers signature verification, but th CVE-2026-572477.8The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objec