Niedrig 2.5Linux-Server
CVE-2026-126064
nokogiri: nokogiri: Denial of Service via use-after-free when replacing attribute values
nokogiri
### Summary Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via `Nokogiri::XML::Node#[]=` or `Nokogiri::XML::Node#lang=`. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault. This is…
10. Nov 2026
Original bei Red Hat öffnen