CVE-2026-57236 sparklemotion CVE debrief

Who should care

Defenders responsible for systems using Nokogiri should verify their version and upgrade to 1.19.4 if necessary. This includes operators of systems that use Nokogiri for parsing XML and HTML, as well as security teams and vulnerability management teams. The vulnerability can have a significant impact on system stability and security if not mitigated.

Why it matters

A vulnerability in Nokogiri allows for a segfault or information leak when setting an invalid encoding, affecting the CRuby implementation. Defenders should verify their Nokogiri version and upgrade to 1.19.4 if necessary.

• Potential segfault or information leak
• Need to verify Nokogiri version and upgrade to 1.19.4
• Possible impact on system stability and security

Technical summary

The Nokogiri library for Ruby has a vulnerability that allows for a segfault or information leak when setting an invalid encoding. This issue affects the CRuby implementation but not JRuby. The vulnerability is caused by calling Document#encoding= with an invalid encoding, which can lead to the document referencing freed memory. The vulnerability is fixed in version 1.19.4. Defenders should prioritize verifying their Nokogiri version and upgrading to 1.19.4 if necessary to mitigate this vulnerability. The vulnerability can be exploited by setting an invalid encoding, which can lead to a segfault or information leak.

Defensive priority

Defenders should prioritize verifying their Nokogiri version and upgrading to 1.19.4 if necessary.

Recommended defensive actions

• Verify Nokogiri version and upgrade to 1.19.4 if necessary
• Review and update affected systems
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and the Nokogiri advisory. The issue is caused by setting an invalid encoding, which can lead to a segfault or information leak. The CVE record was published on 2026-06-25T15:16:40.627Z and has not been modified since then. The vulnerability affects the CRuby implementation of Nokogiri, but not JRuby. The fix is included in version 1.19.4. Defenders should verify their Nokogiri version and consider upgrading to 1.19.4 if necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.