Affected: Alpaquita:23: ruby-nokogiri, Alpaquita:25: ruby-nokogiri, Alpaquita:stream: ruby-nokogiri

Affected: Homebrew: mikutter

## Summary

Nokogiri's `Nokogiri::XSLT::Stylesheet#transform` leaks a small heap allocation when passed a Ruby string parameter containing a null byte.

For applications that pass attacker-controlled input through `XSLT.transform` parameters, this may be a vector for a denial of service attack against long-running processes.

## Mitigation

Upgrade to Nokogiri `>= 1.19.3`.

Users may also be able to mitigate this issue without upgrading by validating untrusted transform parameters before passing them to `Nokogiri::XSLT::Stylesheet#transform`.

## Severity

The Nokogiri maintainers have evaluated this as **Moderate Severity**, CVSS 5.3.

Each leaked allocation is approximately 24–32 bytes, so meaningful memory growth requires sustained attacker-controlled traffic at high call rates. The bug does not cause memory corruption, information disclosure, or any change in the behavior of the transform itself, and the string-handling exception is raised as expected.

Applications that do not pass raw attacker-controlled bytes to XSLT parameters are unlikely to be affected in practice.

## Resources

- [CWE-401: Missing Release of Memory after Effective Lifetime](https://cwe.mitre.org/data/definitions/401.html)

## Credit

This vulnerability was responsibly reported by @Captainjack-kor.

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

Affected: RubyGems: nokogiri

## Summary

Nokogiri's `Nokogiri::XSLT::Stylesheet#transform` leaks a small heap allocation when passed a Ruby string parameter containing a null byte.

For applications that pass attacker-controlled input through `XSLT.transform` parameters, this may be a vector for a denial of service attack against long-running processes.

## Mitigation

Upgrade to Nokogiri `>= 1.19.3`.

Users may also be able to mitigate this issue without upgrading by validating untrusted transform parameters before passing them to `Nokogiri::XSLT::Stylesheet#transform`.

## Severity

The Nokogiri maintainers have evaluated this as **Moderate Severity**, CVSS 5.3.

Each leaked allocation is approximately 24–32 bytes, so meaningful memory growth requires sustained attacker-controlled traffic at high call rates. The bug does not cause memory corruption, information disclosure, or any change in the behavior of the transform itself, and the string-handling exception is raised as expected.

Applications that do not pass raw attacker-controlled bytes to XSLT parameters are unlikely to be affected in practice.

## Resources

- [CWE-401: Missing Release of Memory after Effective Lifetime](https://cwe.mitre.org/data/definitions/401.html)

## Credit

This vulnerability was responsibly reported by @Captainjack-kor.

Affected: Ubuntu:Pro:14.04:LTS: ruby-nokogiri, Ubuntu:16.04:LTS: ruby-nokogiri, Ubuntu:18.04:LTS: ruby-nokogiri, Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri, Ubuntu:24.04:LTS: ruby-nokogiri, Ubuntu:26.04:LTS: ruby-nokogiri

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.