{"affected":[{"product":"nokogiri","source":"CNA: GitHub_M","vendor":"sparklemotion","versions":[{"status":"affected","version":"< 1.19.5"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"nokogiri","product":"nokogiri","source":"OSV GHSA-v995-44v6-5fqm","vendor":"","versions":[{"status":"affected","version":"1.0.0","versionType":"RubyGems"},{"status":"affected","version":"1.0.1","versionType":"RubyGems"},{"status":"affected","version":"1.0.2","versionType":"RubyGems"},{"status":"affected","version":"1.0.3","versionType":"RubyGems"},{"status":"affected","version":"1.0.4","versionType":"RubyGems"},{"status":"affected","version":"1.0.5","versionType":"RubyGems"},{"status":"affected","version":"1.0.6","versionType":"RubyGems"},{"status":"affected","version":"1.0.7","versionType":"RubyGems"},{"status":"affected","version":"1.1.0","versionType":"RubyGems"},{"status":"affected","version":"1.1.1","versionType":"RubyGems"},{"status":"affected","version":"1.10.0","versionType":"RubyGems"},{"status":"affected","version":"1.10.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.10.1","versionType":"RubyGems"},{"status":"affected","version":"1.10.10","versionType":"RubyGems"},{"status":"affected","version":"1.10.2","versionType":"RubyGems"},{"status":"affected","version":"1.10.3","versionType":"RubyGems"},{"status":"affected","version":"1.10.4","versionType":"RubyGems"},{"status":"affected","version":"1.10.5","versionType":"RubyGems"},{"status":"affected","version":"1.10.6","versionType":"RubyGems"},{"status":"affected","version":"1.10.7","versionType":"RubyGems"},{"status":"affected","version":"1.10.8","versionType":"RubyGems"},{"status":"affected","version":"1.10.9","versionType":"RubyGems"},{"status":"affected","version":"1.11.0","versionType":"RubyGems"},{"status":"affected","version":"1.11.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.11.0.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.11.0.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.11.0.rc4","versionType":"RubyGems"},{"status":"affected","version":"1.11.1","versionType":"RubyGems"},{"status":"affected","version":"1.11.2","versionType":"RubyGems"},{"status":"affected","version":"1.11.3","versionType":"RubyGems"},{"status":"affected","version":"1.11.4","versionType":"RubyGems"},{"status":"affected","version":"1.11.5","versionType":"RubyGems"},{"status":"affected","version":"1.11.6","versionType":"RubyGems"},{"status":"affected","version":"1.11.7","versionType":"RubyGems"},{"status":"affected","version":"1.12.0","versionType":"RubyGems"},{"status":"affected","version":"1.12.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.12.1","versionType":"RubyGems"},{"status":"affected","version":"1.12.2","versionType":"RubyGems"},{"status":"affected","version":"1.12.3","versionType":"RubyGems"},{"status":"affected","version":"1.12.4","versionType":"RubyGems"},{"status":"affected","version":"1.12.5","versionType":"RubyGems"},{"status":"affected","version":"1.13.0","versionType":"RubyGems"},{"status":"affected","version":"1.13.1","versionType":"RubyGems"},{"status":"affected","version":"1.13.10","versionType":"RubyGems"},{"status":"affected","version":"1.13.2","versionType":"RubyGems"},{"status":"affected","version":"1.13.3","versionType":"RubyGems"},{"status":"affected","version":"1.13.4","versionType":"RubyGems"},{"status":"affected","version":"1.13.5","versionType":"RubyGems"},{"status":"affected","version":"1.13.6","versionType":"RubyGems"},{"status":"affected","version":"1.13.7","versionType":"RubyGems"},{"status":"affected","version":"1.13.8","versionType":"RubyGems"},{"status":"affected","version":"1.13.9","versionType":"RubyGems"},{"status":"affected","version":"1.14.0","versionType":"RubyGems"},{"status":"affected","version":"1.14.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.14.1","versionType":"RubyGems"},{"status":"affected","version":"1.14.2","versionType":"RubyGems"},{"status":"affected","version":"1.14.3","versionType":"RubyGems"},{"status":"affected","version":"1.14.4","versionType":"RubyGems"},{"status":"affected","version":"1.14.5","versionType":"RubyGems"},{"status":"affected","version":"1.15.0","versionType":"RubyGems"},{"status":"affected","version":"1.15.1","versionType":"RubyGems"},{"status":"affected","version":"1.15.2","versionType":"RubyGems"},{"status":"affected","version":"1.15.3","versionType":"RubyGems"},{"status":"affected","version":"1.15.4","versionType":"RubyGems"},{"status":"affected","version":"1.15.5","versionType":"RubyGems"},{"status":"affected","version":"1.15.6","versionType":"RubyGems"},{"status":"affected","version":"1.15.7","versionType":"RubyGems"},{"status":"affected","version":"1.16.0","versionType":"RubyGems"},{"status":"affected","version":"1.16.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.16.1","versionType":"RubyGems"},{"status":"affected","version":"1.16.2","versionType":"RubyGems"},{"status":"affected","version":"1.16.3","versionType":"RubyGems"},{"status":"affected","version":"1.16.4","versionType":"RubyGems"},{"status":"affected","version":"1.16.5","versionType":"RubyGems"},{"status":"affected","version":"1.16.6","versionType":"RubyGems"},{"status":"affected","version":"1.16.7","versionType":"RubyGems"},{"status":"affected","version":"1.16.8","versionType":"RubyGems"},{"status":"affected","version":"1.17.0","versionType":"RubyGems"},{"status":"affected","version":"1.17.1","versionType":"RubyGems"},{"status":"affected","version":"1.17.2","versionType":"RubyGems"},{"status":"affected","version":"1.18.0","versionType":"RubyGems"},{"status":"affected","version":"1.18.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.18.1","versionType":"RubyGems"},{"status":"affected","version":"1.18.10","versionType":"RubyGems"},{"status":"affected","version":"1.18.2","versionType":"RubyGems"},{"status":"affected","version":"1.18.3","versionType":"RubyGems"},{"status":"affected","version":"1.18.4","versionType":"RubyGems"},{"status":"affected","version":"1.18.5","versionType":"RubyGems"},{"status":"affected","version":"1.18.6","versionType":"RubyGems"},{"status":"affected","version":"1.18.7","versionType":"RubyGems"},{"status":"affected","version":"1.18.8","versionType":"RubyGems"},{"status":"affected","version":"1.18.9","versionType":"RubyGems"},{"status":"affected","version":"1.19.0","versionType":"RubyGems"},{"status":"affected","version":"1.19.1","versionType":"RubyGems"},{"status":"affected","version":"1.19.2","versionType":"RubyGems"},{"status":"affected","version":"1.19.3","versionType":"RubyGems"},{"status":"affected","version":"1.19.4","versionType":"RubyGems"},{"status":"affected","version":"1.2.0","versionType":"RubyGems"},{"status":"affected","version":"1.2.1","versionType":"RubyGems"},{"status":"affected","version":"1.2.2","versionType":"RubyGems"},{"status":"affected","version":"1.2.3","versionType":"RubyGems"},{"status":"affected","version":"1.3.0","versionType":"RubyGems"},{"status":"affected","version":"1.3.1","versionType":"RubyGems"},{"status":"affected","version":"1.3.2","versionType":"RubyGems"},{"status":"affected","version":"1.3.3","versionType":"RubyGems"},{"status":"affected","version":"1.4.0","versionType":"RubyGems"},{"status":"affected","version":"1.4.1","versionType":"RubyGems"},{"status":"affected","version":"1.4.2","versionType":"RubyGems"},{"status":"affected","version":"1.4.2.1","versionType":"RubyGems"},{"status":"affected","version":"1.4.3","versionType":"RubyGems"},{"status":"affected","version":"1.4.3.1","versionType":"RubyGems"},{"status":"affected","version":"1.4.4","versionType":"RubyGems"},{"status":"affected","version":"1.4.4.1","versionType":"RubyGems"},{"status":"affected","version":"1.4.4.2","versionType":"RubyGems"},{"status":"affected","version":"1.4.5","versionType":"RubyGems"},{"status":"affected","version":"1.4.6","versionType":"RubyGems"},{"status":"affected","version":"1.4.7","versionType":"RubyGems"},{"status":"affected","version":"1.5.0","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.beta.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.beta.2","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.beta.3","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.beta.4","versionType":"RubyGems"},{"status":"affected","version":"1.5.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.1.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.5.10","versionType":"RubyGems"},{"status":"affected","version":"1.5.11","versionType":"RubyGems"},{"status":"affected","version":"1.5.2","versionType":"RubyGems"},{"status":"affected","version":"1.5.3","versionType":"RubyGems"},{"status":"affected","version":"1.5.3.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.5.3.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.5.3.rc4","versionType":"RubyGems"},{"status":"affected","version":"1.5.3.rc5","versionType":"RubyGems"},{"status":"affected","version":"1.5.3.rc6","versionType":"RubyGems"},{"status":"affected","version":"1.5.4","versionType":"RubyGems"},{"status":"affected","version":"1.5.4.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.5.4.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.5.4.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.5.5","versionType":"RubyGems"},{"status":"affected","version":"1.5.5.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.5.5.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.5.5.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.5.6","versionType":"RubyGems"},{"status":"affected","version":"1.5.6.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.5.6.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.5.6.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.5.7","versionType":"RubyGems"},{"status":"affected","version":"1.5.7.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.5.7.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.5.7.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.5.8","versionType":"RubyGems"},{"status":"affected","version":"1.5.9","versionType":"RubyGems"},{"status":"affected","version":"1.6.0","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.6.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.2","versionType":"RubyGems"},{"status":"affected","version":"1.6.2.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.2.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.6.2.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.6.2.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.6.3","versionType":"RubyGems"},{"status":"affected","version":"1.6.3.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.3.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.6.3.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.6.3.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.6.4","versionType":"RubyGems"},{"status":"affected","version":"1.6.4.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.5","versionType":"RubyGems"},{"status":"affected","version":"1.6.6.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.6.2","versionType":"RubyGems"},{"status":"affected","version":"1.6.6.3","versionType":"RubyGems"},{"status":"affected","version":"1.6.6.4","versionType":"RubyGems"},{"status":"affected","version":"1.6.7","versionType":"RubyGems"},{"status":"affected","version":"1.6.7.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.7.2","versionType":"RubyGems"},{"status":"affected","version":"1.6.7.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.6.7.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.6.7.rc4","versionType":"RubyGems"},{"status":"affected","version":"1.6.8","versionType":"RubyGems"},{"status":"affected","version":"1.6.8.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.8.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.6.8.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.6.8.rc3","versionType":"RubyGems"},{"status":"affected","version":"1.7.0","versionType":"RubyGems"},{"status":"affected","version":"1.7.0.1","versionType":"RubyGems"},{"status":"affected","version":"1.7.1","versionType":"RubyGems"},{"status":"affected","version":"1.7.2","versionType":"RubyGems"},{"status":"affected","version":"1.8.0","versionType":"RubyGems"},{"status":"affected","version":"1.8.1","versionType":"RubyGems"},{"status":"affected","version":"1.8.2","versionType":"RubyGems"},{"status":"affected","version":"1.8.3","versionType":"RubyGems"},{"status":"affected","version":"1.8.4","versionType":"RubyGems"},{"status":"affected","version":"1.8.5","versionType":"RubyGems"},{"status":"affected","version":"1.9.0","versionType":"RubyGems"},{"status":"affected","version":"1.9.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.9.1","versionType":"RubyGems"},{"events":[{"introduced":"0"},{"fixed":"1.19.5"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-126062","cwes":["CWE-611","CWE-918"],"description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.","epss":{"date":"2026-11-12","percentile":0.32489,"score":0.0038},"exploits":[],"kev":null,"metrics":[{"score":3.7,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},{"score":3.7,"severity":"low","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794506514547,"publishedAt":1794341506316,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-v995-44v6-5fqm"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-v995-44v6-5fqm"}],"remediation":[{"kind":"fix","source":"OSV GHSA-v995-44v6-5fqm","text":"nokogiri (RubyGems): OSV reports a fixed version 1.19.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-v995-44v6-5fqm"}],"revision":"3e005cc94628676e3e8ca3d3a4a287a7418cff1bb78da2a1b8b8103951e441f6","sources":[{"modifiedAt":1794506514547,"name":"CNA: GitHub_M","retrievedAt":1794510576335,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126062"},{"modifiedAt":1794341950030,"name":"NVD","retrievedAt":1794357098337,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126062"},{"modifiedAt":1794344404025,"name":"OSV / GitHub Security Advisories","retrievedAt":1794346828546,"url":"https://osv.dev/vulnerability/GHSA-v995-44v6-5fqm"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794510584114,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-126062"}],"ssvc":{"assessedAt":1794500781600,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set","updatedAt":1794510584114}