JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
GHSA-v995-44v6-5fqm · CVE-2026-126062
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Summary
On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF.
Nokogiri 1.19.5 applies the XML::Schema check from GHSA-8678-w3jw-xfc2: with NONET set, only local resources are loaded.
Only JRuby is affected. Default parse options are not affected.
Severity
The Nokogiri maintainers have evaluated this as low severity.
Mitigation
Upgrade to Nokogiri 1.19.5 or later, or do not enable DTDLOAD, DTDVALID or NOENT for untrusted input.
Credit
This issue was responsibly reported by @arpitjain099.
References
- WEB https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm
- WEB https://github.com/sparklemotion/nokogiri/pull/3752
- WEB https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8
- WEB https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac
- WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-v995-44v6-5fqm.yml
- PACKAGE https://github.com/sparklemotion/nokogiri
- WEB https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5
Ready to move
Start Securing
Free, no credit card | First findings in minutes