2026-05-23T20:12:48+00:00 https://rubysec.com/ Jekyll https://rubysec.com/advisories/CVE-2026-44837 2026-05-08T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-44836 2026-05-08T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-40295 2026-05-08T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-44511 2026-05-07T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-44312 2026-05-07T00:00:00+00:00 https://rubysec.com/advisories/CVE-2025-67202 2026-05-07T00:00:00+00:00 https://rubysec.com/advisories/GHSA-v2fc-qm4h-8hqv 2026-05-06T00:00:00+00:00 = 1.19.3`. Users may also be able to mitigate this issue without upgrading by validating untrusted transform parameters before passing them to `Nokogiri::XSLT::Stylesheet#transform`. ## Severity The Nokogiri maintainers have evaluated this as **Moderate Severity**, CVSS 5.3. Each leaked allocation is approximately 24–32 bytes, so meaningful memory growth requires sustained attacker-controlled traffic at high call rates. The bug does not cause memory corruption, information disclosure, or any change in the behavior of the transform itself, and the string-handling exception is raised as expected. Applications that do not pass raw attacker-controlled bytes to XSLT parameters are unlikely to be affected in practice. ## Resources - [CWE-401: Missing Release of Memory after Effective Lifetime](https://cwe.mitre.org/data/definitions/401.html) ## Credit This vulnerability was responsibly reported by @Captainjack-kor.]]> https://rubysec.com/advisories/GHSA-c4rq-3m3g-8wgx 2026-05-06T00:00:00+00:00 = 1.19.3`. If users are unable to upgrade, two options are available: - Avoid the use of attacker-controlled text in CSS selectors. Applications that only pass developer-authored selectors to Nokogiri are not directly exposed. - Set global `Regexp.timeout` (Ruby 3.2+, JRuby 9.4+) to bound parse time. ## Severity The Nokogiri maintainers have evaluated this as **High Severity** (CVSS 7.5, `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`). An attacker able to inject user-supplied text into a CSS selector parse method can cause exponential backtracking, resulting in a potential denial of service. ## Resources - [CWE-1333: Inefficient Regular Expression Complexity](https://cwe.mitre.org/data/definitions/1333.html) ## Credit Vector 1 was responsibly reported by @colby-swandale. Vectors 2 and 3 were discovered by @flavorjones during the response to the original report.]]> https://rubysec.com/advisories/GHSA-3h96-34p3-xm76 2026-05-05T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42258 2026-05-04T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42257 2026-05-04T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42256 2026-05-04T00:00:00+00:00 A hostile server can perform a computational denial-of-service attack on > clients by sending a big iteration count value. In order to defend against > that, a client implementation can pick a maximum iteration count that it is > willing to use and reject any values that exceed that threshold (in such > cases, the client, of course, has to fail the authentication). ### Impact During SCRAM authentication to a hostile server, the entire Ruby VM will be locked for the duration of the computation. Depending on hardware capabilities and OpenSSL version, this may take many minutes. `OpenSSL::KDF.pbkdf2_hmac` is a blocking C function, so `Timeout` cannot be used to guard against this. And it retains the Global VM lock, so other ruby threads will also be unable to run. ### Mitigation * Upgrade to a patched version of `net-imap` that adds the `max_iterations` option to the `SASL-*` authenticators, and call `Net::IMAP#authenticate` with a `max_iterations` keyword argument. **NOTE:** The default `max_iterations` is `2³¹ - 1`, the maximum signed 32 bit integer, the maximum allowed by OpenSSL. _To prevent a denial of service attack,_ this must be set to a safe value, depending on hardware and version of OpenSSL. _It is the user's responsibility_ to enforce minimum and maximum iteration counts that are appropriate for their security context. * Alternatively, avoid `SCRAM-*` mechanisms when authenticating to untrusted servers.]]> https://rubysec.com/advisories/CVE-2026-42246 2026-05-04T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42245 2026-05-04T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42205 2026-04-24T00:00:00+00:00 https://rubysec.com/advisories/GHSA-2wvh-87g2-89hr 2026-04-23T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42087 2026-04-23T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42086 2026-04-22T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42085 2026-04-22T00:00:00+00:00 https://rubysec.com/advisories/CVE-2026-42084 2026-04-22T00:00:00+00:00