https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:57:12.659414+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-57434 BELL-CVE-2026-57434 2026-10-02T16:57:12.780599+00:00

Affected: Alpaquita:stream: ruby-nokogiri

 https://cve.radiocsirt.org/vuln/brew-mikutter-cve-2026-57434 BREW-mikutter-CVE-2026-57434 — Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes 2026-10-02T16:57:12.780651+00:00

Affected: Homebrew: mikutter

### Summary

Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process.

Nokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`.

JRuby is not affected.

### Severity

The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.

### Mitigation

Upgrade to Nokogiri 1.19.4 or later.

Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.

### Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

 https://cve.radiocsirt.org/vuln/euvd-2026-330319 EUVD-2026-330319 2026-10-02T16:57:12.780691+00:00 EUVD-2026-330319 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57434 fkie_cve-2026-57434 2026-10-02T16:57:12.780705+00:00

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

 https://cve.radiocsirt.org/vuln/ghsa-9cv2-cfxc-v4v2 GHSA-9cv2-cfxc-v4v2 — Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes 2026-10-02T16:57:12.780729+00:00

Affected: RubyGems: nokogiri

### Summary

Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process.

Nokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`.

JRuby is not affected.

### Severity

The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.

### Mitigation

Upgrade to Nokogiri 1.19.4 or later.

Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.

### Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-57434 msrc_CVE-2026-57434 — Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes 2026-10-02T16:57:12.780759+00:00 msrc_CVE-2026-57434 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-57434 UBUNTU-CVE-2026-57434 2026-10-02T16:57:12.780777+00:00

Affected: Ubuntu:Pro:14.04:LTS: ruby-nokogiri, Ubuntu:16.04:LTS: ruby-nokogiri, Ubuntu:18.04:LTS: ruby-nokogiri, Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri, Ubuntu:24.04:LTS: ruby-nokogiri, Ubuntu:25.10: ruby-nokogiri, Ubuntu:26.04:LTS: ruby-nokogiri

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.