CVE-2026-126062— Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set

Quick assessment

Affected

sparklemotion nokogiri

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nokogiri 是一款面向 Ruby 编程语言的开源 XML 和 HTML 处理库。在 1.19.5 版本之前，在 JRuby 环境下，若应用程序使用 DTDLOAD、DTDVALID 或 NOENT 选项解析不可信的 XML 内容，当外部 DTD 或实体使用短格式 IPv4 主机地址，或使用了基于网络 URL 解析的绝对路径时，NONET 限制可能被绕过。解析器可能将这些标识符视为本地资源，从而发起网络请求，进而可能导致服务器端请求伪造（SSRF）攻击。此问题不影响 CRuby 环境及默认解析选项。该漏洞已在

CVSS 3.7 · Low Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1081.002 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set

Source: CVE Program / CVE List V5

Vulnerability Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

XML外部实体引用的不恰当限制(XXE)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
sparklemotion	nokogiri	< 1.19.5	-

II. Public POCs for CVE-2026-126062

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126062

请登录查看更多情报信息。

Other References for CVE-2026-126062 (5)

https://github.com/sparklemotion/nokogiri/pull/3752 x_refsource_MISC
https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5 x_refsource_MISC
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm x_refsource_CONFIRM
https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac x_refsource_MISC
https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-126062

Same Patch Batch · sparklemotion · 2026-11-10 · 3 CVEs total

CVE-2026-126063	2.3 LOW	Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
CVE-2026-126064	2.0 LOW	Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node

IV. Related Vulnerabilities

Same product: nokogiri

Same vendor: sparklemotion

Same weakness: CWE-611