Description (CNA)
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| sparklemotion / nokogiri | affected 0 before 1.19.3; unaffected 1.19.3 |
CWE
CWE-401
References
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv
- https://www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transform
ADP enrichment
No English description supplied.
No references supplied.