{"id":"EM-20261110-DU35","url":"https://cyber.eventmonitor.net/incident/EM-20261110-DU35/nokogiri-vulnerability-cve-2026-126062/","type":"cve","title":"Nokogiri Vulnerability (CVE-2026-126062)","subtitle":"CVE-2026-126062","subject":"CVE-2026-126062","status":"Developing","severity":"info","affected":[],"headline":null,"born":"2026-11-10T20:52:38.000Z","firstSignal":"2026-11-10T20:11:46.000Z","lastSignal":"2026-11-10T20:52:38.000Z","updated":"2026-11-11T12:38:43.721Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T20:52:38.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-10T20:52:38.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T20:11:46.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-10T20:52:38.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261110-DU35 created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T20:19:10.030Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T20:19:10.030Z","detail":"CVSS 3.7"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-10T20:11:46.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T20:11:46.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":1,"title":"Red Hat: CVE-2026-126062 (low)","text":"nokogiri: nokogiri: Server-Side Request Forgery via network restriction bypass on JRuby","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-126062.json"},{"at":"2026-11-10T20:52:38.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":1,"title":"GHSA-v995-44v6-5fqm / CVE-2026-126062: JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host","text":"rubygems:nokogiri","url":"https://github.com/advisories/GHSA-v995-44v6-5fqm"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T20:19:10.030","score":3.7,"severity":"LOW","desc":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute…","product":"","seen":1794349485599},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}