{"id":"EM-20261110-UPP9","url":"https://cyber.eventmonitor.net/incident/EM-20261110-UPP9/nokogiri-vulnerability-cve-2026-126064/","type":"cve","title":"Nokogiri Vulnerability (CVE-2026-126064)","subtitle":"CVE-2026-126064","subject":"CVE-2026-126064","status":"Developing","severity":"info","affected":[],"headline":null,"born":"2026-11-10T20:51:19.000Z","firstSignal":"2026-11-10T20:17:13.000Z","lastSignal":"2026-11-10T20:51:19.000Z","updated":"2026-11-11T12:38:43.721Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T20:51:19.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-10T20:51:19.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T20:17:13.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-10T20:51:19.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261110-UPP9 created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T21:19:24.147Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T21:19:24.147Z","detail":"CVSS 2"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-10T20:17:13.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T20:17:13.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":1,"title":"Red Hat: CVE-2026-126064 (low)","text":"nokogiri: nokogiri: Denial of Service via use-after-free when replacing attribute values","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-126064.json"},{"at":"2026-11-10T20:51:19.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":1,"title":"GHSA-3w22-6jfg-527w / CVE-2026-126064: Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value","text":"rubygems:nokogiri","url":"https://github.com/advisories/GHSA-3w22-6jfg-527w"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T21:19:24.147","score":2,"severity":"LOW","desc":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the…","product":"","seen":1794353084878},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}