CVE-2026-79771 sparklemotion CVE debrief

Who should care

Developers and administrators using Nokogiri versions before 1.19.3 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes upgrading to version 1.19.3 or later, restricting input to XSLT transform parameters, and monitoring long-running processes for denial of service.

Technical summary

The Nokogiri library versions before 1.19.3 contain a memory leak vulnerability in the XSLT Stylesheet transform method. This occurs when processing Ruby strings containing null bytes. An attacker can exploit this vulnerability by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

Defensive priority

Medium-priority defensive actions are required to address the memory leak vulnerability in Nokogiri versions before 1.19.3.

Recommended defensive actions

• Verify Nokogiri version and upgrade to 1.19.3 or later if necessary
• Restrict input to XSLT transform parameters to prevent null bytes
• Monitor long-running processes for denial of service
• Implement compensating controls to detect and prevent potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE description indicates that Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method. Limited evidence suggests that attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes. Further verification is needed to confirm affected scope and inventory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.