CVE-2026-126062

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.5

Description On JRuby, the NONET parse option fails to block external DTDs or entities when the system identifier uses a short-form IPv4 host (e.g., http://127.1/) or an absolute path (e.g., /x.dtd) resolved against a network URL. When an application parses untrusted XML using DTDLOAD, DTDVALID, or NOENT, the resolver may treat these identifiers as local and initiate a network request, potentially enabling server-side request forgery (SSRF), which is a technique used to induce a server to make requests to an unintended location.

Recommendations Update to version 1.19.5. Avoid enabling DTDLOAD, DTDVALID, or NOENT for untrusted input.