Niedrig 3.7Linux-Server
CVE-2026-126062
nokogiri: nokogiri: Server-Side Request Forgery via network restriction bypass on JRuby
nokogiri
### Summary On JRuby, the `NONET` parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as `http://127.1/` or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a document parsed from a network URL. An application that parses untrusted XML with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests, potentially enabling SSRF. Nokogiri 1.19.5 applies the `XML::Schema` check from…
10. Nov 2026
Original bei Red Hat öffnen