Executive brief
Nokogiri's XSLT transform functionality leaks small heap allocations (24–32 bytes each) when processing Ruby strings containing null bytes. While individual leaks are tiny, sustained attacker-controlled traffic at high call rates in long-running applications can cause progressive memory growth, potentially leading to service degradation or crashes. The vulnerability requires direct exposure of user input to XSLT transform parameters, which affects applications that process untrusted XML transformation requests.
Technical details
The vulnerability is a memory leak (CWE-401) in Nokogiri's XSLT transform implementation. When the transform method receives a Ruby string parameter containing a null byte, it fails to release a heap allocation (approximately 24–32 bytes per occurrence). The bug is triggered on any call to Nokogiri::XSLT::Stylesheet#transform with crafted input, requiring no authentication or special privileges and reachable via network in web applications. Each individual leak is small, but sustained high-rate calls with attacker-controlled parameters can cause cumulative memory exhaustion in long-running processes. The vulnerability does not cause memory corruption, information disclosure, or behavioral changes to the transform itself; a string-handling exception is raised as expected. Patch available in Nokogiri version 1.19.3 and later.
Affected products
- Sparklemotion Nokogiri < 1.19.3
Timeline
- 2026-04-27: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-05-06: patched: Patch released in Nokogiri 1.19.3
References
- https://api.github.com/users/Captainjack-kor
- https://github.com/Captainjack-kor
- https://api.github.com/users/Captainjack-kor/gists%7B/gist_id%7D
- https://api.github.com/users/Captainjack-kor/repos
- https://avatars.githubusercontent.com/u/79830954?v=4
- https://api.github.com/users/Captainjack-kor/events%7B/privacy%7D