{"id":"CVE-2026-126062","kind":"vulnerability","aliases":["CVE-2026-126062","GHSA-v995-44v6-5fqm"],"related":[],"title":"JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host","description":"### Summary\n\nOn JRuby, the `NONET` parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as `http://127.1/` or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a document parsed from a network URL. An application that parses untrusted XML with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests, potentially enabling SSRF.\n\nNokogiri 1.19.5 applies the `XML::Schema` check from [GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2): with `NONET` set, only local resources are loaded.\n\nOnly JRuby is affected. Default parse options are not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later, or do not enable `DTDLOAD`, `DTDVALID` or `NOENT` for untrusted input.\n\n### Credit\n\nThis issue was responsibly reported by @arpitjain099.","summary":"On JRuby, Nokogiri's NONET parse option fails to block external DTDs and entities whose system identifier uses a short-form IPv4 host or an absolute path. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT can be made to send network requests, enabling SSRF.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nokogiri","fixed":["1.19.5"],"affected":"< 1.19.5","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-611","cwe-918","jruby","nokogiri","package","ruby"],"not_affected_if":["default-config","mri-ruby","trusted-input-only"],"how_to_check":"- Check the Nokogiri version in the Gemfile.lock for `nokogiri` and confirm whether it is below `1.19.5`.\n- Confirm the application runs on JRuby.\n- Search the code for parse calls that enable `DTDLOAD`, `DTDVALID` or `NOENT` on untrusted input.","fix":"- Nokogiri: upgrade to `1.19.5` or later.\n- Alternatively, do not enable `DTDLOAD`, `DTDVALID` or `NOENT` for untrusted input.","status":"open","published_at":"2026-11-10T20:19:10+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","triaged_at":"2026-11-10T20:57:46+00:00","updated_at":"2026-11-10T20:57:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:57:46Z","model":"claude-haiku-5-5","output":{"fix":"- Nokogiri: upgrade to `1.19.5` or later.\n- Alternatively, do not enable `DTDLOAD`, `DTDVALID` or `NOENT` for untrusted input.","reach":"internet","title":"Nokogiri on JRuby: NONET bypass lets XML parsing make network requests","impact":"low","summary":"On JRuby, Nokogiri's NONET parse option fails to block external DTDs and entities whose system identifier uses a short-form IPv4 host or an absolute path. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT can be made to send network requests, enabling SSRF.","audience":"developers","category":"package","nicknames":[],"who_cares":["nokogiri","jruby","ruby"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Server sends network requests to internal hosts, enabling SSRF","analyst_note":"","how_to_check":"- Check the Nokogiri version in the Gemfile.lock for `nokogiri` and confirm whether it is below `1.19.5`.\n- Confirm the application runs on JRuby.\n- Search the code for parse calls that enable `DTDLOAD`, `DTDVALID` or `NOENT` on untrusted input.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","mri-ruby","trusted-input-only"],"who_is_affected":"Only applications running Nokogiri on JRuby are affected; the advisory states default parse options are not affected. The risk requires parsing untrusted XML with DTDLOAD, DTDVALID or NOENT enabled, so teams that only parse trusted XML or keep defaults can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000824,"input_tokens":5052,"output_tokens":638,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126062':22A,30A '-2026':21A,29A '-611':33B '-8678':164C '-918':35B '/sparklemotion/nokogiri/security/advisories/ghsa-8678-w3jw-xfc2):':170C '/x.dtd':125C '1.19.5':156C,203C '127.1':115C '169.254.43518':117C '44v6':26A '5fqm':27A 'absolut':66B,121C 'affect':182C,188C 'appli':157C 'applic':69B,135C 'arpitjain099':224C 'block':49B,97C 'bypass':4A 'check':161C 'could':145C 'credit':217C 'cve':20A,28A 'cwe':32B,34B 'default':183C 'document':128C 'dtd':100C 'dtdload':75B,141C,210C 'dtds':7A,51B 'dtdvalid':76B,142C,211C 'enabl':86B,153C,209C 'entiti':9A,53B,102C 'evalu':194C 'extern':6A,50B,99C 'fail':47B 'form':17A,61B,110C 'ghsa':24A,163C 'ghsa-v995-44v6-5fqm':23A 'github.com':169C 'github.com/sparklemotion/nokogiri/security/advisories/ghsa-8678-w3jw-xfc2):':168C 'host':19A,63B,112C 'identifi':56B,105C 'input':216C 'ipv4':18A,62B,111C 'issu':219C 'jrubi':1A,36B,41B,90C,180C 'later':205C 'load':178C 'local':175C 'low':197C 'made':81B,147C 'maintain':192C 'mitig':199C 'network':84B,132C,150C 'noent':78B,144C,213C 'nokogiri':31A,37B,42B,155C,191C,202C 'nonet':2A,44B,92C,172C 'option':46B,94C,185C 'packag':38B 'pars':45B,71B,93C,129C,137C,184C 'path':67B,122C 'potenti':152C 'report':222C 'request':85B,151C 'resourc':176C 'respons':221C 'rubi':39B 'schema':160C 'send':83B,149C 'set':173C 'sever':189C,198C 'short':16A,60B,109C 'short-form':15A,59B,108C 'ssrf':87B,154C 'summari':88C 'system':55B,104C 'systemid':12A 'untrust':72B,138C,215C 'upgrad':200C 'url':133C 'use':13A,57B,106C 'v995':25A 'w3jw':166C 'w3jw-xfc2':165C 'whose':54B,103C 'xfc2':167C 'xml':73B,139C,159C","nicknames":[],"mitigations":[],"who_affected":"Only applications running Nokogiri on JRuby are affected; the advisory states default parse options are not affected. The risk requires parsing untrusted XML with DTDLOAD, DTDVALID or NOENT enabled, so teams that only parse trusted XML or keep defaults can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nokogiri"],"ptokens":["nokogiri"],"labels":["cwe611","cwe918","jruby","low","nokogiri","package","ruby","rubygems"],"campaign_type":null,"search_a":"'-126062':22A,30A '-2026':21A,29A '44v6':26A '5fqm':27A 'bypass':4A 'cve':20A,28A 'dtds':7A 'entiti':9A 'extern':6A 'form':17A 'ghsa':24A 'ghsa-v995-44v6-5fqm':23A 'host':19A 'ipv4':18A 'jrubi':1A 'nokogiri':31A 'nonet':2A 'short':16A 'short-form':15A 'systemid':12A 'use':13A 'v995':25A","search_b":"'-611':33B '-918':35B 'absolut':66B 'applic':69B 'block':49B 'cwe':32B,34B 'dtdload':75B 'dtds':51B 'dtdvalid':76B 'enabl':86B 'entiti':53B 'extern':50B 'fail':47B 'form':61B 'host':63B 'identifi':56B 'ipv4':62B 'jrubi':36B,41B 'made':81B 'network':84B 'noent':78B 'nokogiri':37B,42B 'nonet':44B 'option':46B 'packag':38B 'pars':45B,71B 'path':67B 'request':85B 'rubi':39B 'send':83B 'short':60B 'short-form':59B 'ssrf':87B 'system':55B 'untrust':72B 'use':57B 'whose':54B 'xml':73B","search_c":"'-8678':164C '/sparklemotion/nokogiri/security/advisories/ghsa-8678-w3jw-xfc2):':170C '/x.dtd':125C '1.19.5':156C,203C '127.1':115C '169.254.43518':117C 'absolut':121C 'affect':182C,188C 'appli':157C 'applic':135C 'arpitjain099':224C 'block':97C 'check':161C 'could':145C 'credit':217C 'default':183C 'document':128C 'dtd':100C 'dtdload':141C,210C 'dtdvalid':142C,211C 'enabl':153C,209C 'entiti':102C 'evalu':194C 'extern':99C 'form':110C 'ghsa':163C 'github.com':169C 'github.com/sparklemotion/nokogiri/security/advisories/ghsa-8678-w3jw-xfc2):':168C 'host':112C 'identifi':105C 'input':216C 'ipv4':111C 'issu':219C 'jrubi':90C,180C 'later':205C 'load':178C 'local':175C 'low':197C 'made':147C 'maintain':192C 'mitig':199C 'network':132C,150C 'noent':144C,213C 'nokogiri':155C,191C,202C 'nonet':92C,172C 'option':94C,185C 'pars':93C,129C,137C,184C 'path':122C 'potenti':152C 'report':222C 'request':151C 'resourc':176C 'respons':221C 'schema':160C 'send':149C 'set':173C 'sever':189C,198C 'short':109C 'short-form':108C 'ssrf':154C 'summari':88C 'system':104C 'untrust':138C,215C 'upgrad':200C 'url':133C 'use':106C 'w3jw':166C 'w3jw-xfc2':165C 'whose':103C 'xfc2':167C 'xml':139C,159C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T03:45:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126062","severity":null,"published_at":"2026-11-10T20:19:10+00:00","modified_at":"2026-11-10T20:19:10+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:04+00:00","note":null},{"source":"ghsa","external_id":"GHSA-v995-44v6-5fqm","url":"https://github.com/advisories/GHSA-v995-44v6-5fqm","severity":"low","published_at":"2026-11-10T20:52:38+00:00","modified_at":"2026-11-10T20:52:39+00:00","first_seen_at":"2026-11-10T20:56:29+00:00","fetched_at":"2026-11-10T20:57:07+00:00","note":null}],"documents":[{"id":118160,"url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":118161,"url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":118162,"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":118163,"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T03:45:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":118432,"url":"https://api.github.com/repos/sparklemotion/nokogiri/security-advisories/GHSA-v995-44v6-5fqm","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":118302,"url":"https://github.com/sparklemotion/nokogiri/pull/3752","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}