https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:47:39 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-57434 <p><strong>Affected:</strong> Alpaquita:stream: ruby-nokogiri</p> <p><strong>Affected:</strong> Alpaquita:stream: ruby-nokogiri</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-57434 https://cve.radiocsirt.org/vuln/brew-mikutter-cve-2026-57434 <p><strong>Affected:</strong> Homebrew: mikutter</p> <p>### Summary</p> <p>Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process.</p> <p>Nokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`.</p> <p>JRuby is not affected.</p> <p>### Severity</p> <p>The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.</p> <p>### Mitigation</p> <p>Upgrade to Nokogiri 1.19.4 or later.</p> <p>Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.</p> <p>### Credit</p> <p>This issue was responsibly reported by Zheng Yu from depthfirst.com.</p> <p><strong>Affected:</strong> Homebrew: mikutter</p> <p>### Summary</p> <p>Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process.</p> <p>Nokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`.</p> <p>JRuby is not affected.</p> <p>### Severity</p> <p>The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.</p> <p>### Mitigation</p> <p>Upgrade to Nokogiri 1.19.4 or later.</p> <p>Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.</p> <p>### Credit</p> <p>This issue was responsibly reported by Zheng Yu from depthfirst.com.</p> https://cve.radiocsirt.org/vuln/brew-mikutter-cve-2026-57434 https://cve.radiocsirt.org/vuln/euvd-2026-330319 EUVD-2026-330319 https://cve.radiocsirt.org/vuln/euvd-2026-330319 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57434 <p>Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.</p> <p>Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-57434 https://cve.radiocsirt.org/vuln/ghsa-9cv2-cfxc-v4v2 <p><strong>Affected:</strong> RubyGems: nokogiri</p> <p>### Summary</p> <p>Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process.</p> <p>Nokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`.</p> <p>JRuby is not affected.</p> <p>### Severity</p> <p>The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.</p> <p>### Mitigation</p> <p>Upgrade to Nokogiri 1.19.4 or later.</p> <p>Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.</p> <p>### Credit</p> <p>This issue was responsibly reported by Zheng Yu from depthfirst.com.</p> <p><strong>Affected:</strong> RubyGems: nokogiri</p> <p>### Summary</p> <p>Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process.</p> <p>Nokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`.</p> <p>JRuby is not affected.</p> <p>### Severity</p> <p>The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.</p> <p>### Mitigation</p> <p>Upgrade to Nokogiri 1.19.4 or later.</p> <p>Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.</p> <p>### Credit</p> <p>This issue was responsibly reported by Zheng Yu from depthfirst.com.</p> https://cve.radiocsirt.org/vuln/ghsa-9cv2-cfxc-v4v2 https://cve.radiocsirt.org/vuln/msrc_cve-2026-57434 msrc_CVE-2026-57434 https://cve.radiocsirt.org/vuln/msrc_cve-2026-57434 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-57434 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: ruby-nokogiri, Ubuntu:16.04:LTS: ruby-nokogiri, Ubuntu:18.04:LTS: ruby-nokogiri, Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri, Ubuntu:24.04:LTS: ruby-nokogiri, Ubuntu:25.10: ruby-nokogiri, Ubuntu:26.04:LTS: ruby-nokogiri</p> <p>Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: ruby-nokogiri, Ubuntu:16.04:LTS: ruby-nokogiri, Ubuntu:18.04:LTS: ruby-nokogiri, Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri, Ubuntu:24.04:LTS: ruby-nokogiri, Ubuntu:25.10: ruby-nokogiri, Ubuntu:26.04:LTS: ruby-nokogiri</p> <p>Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-57434