Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set
Published: November 02, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-v995-44v6-5fqm
- Vendor Advisory: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm
GEM
PLATFORM
SEVERITY
CVSS v3.x: 3.7 (Low)
PATCHED VERSIONS
>= 1.19.5
DESCRIPTION
Summary
On JRuby, the NONET parse option did not block an external DTD or entity
whose system identifier used a short-form IPv4 host, such as http://127.1/
or http://169.254.43518/, or was an absolute path such as /x.dtd in a
document parsed from a network URL. An application that parses untrusted XML
with DTDLOAD, DTDVALID or NOENT could be made to send network requests,
potentially enabling SSRF.
Nokogiri 1.19.5 applies the XML::Schema check from
GHSA-8678-w3jw-xfc2:
with NONET set, only local resources are loaded.
Only JRuby is affected. Default parse options are not affected.
Severity
The Nokogiri maintainers have evaluated this as low severity (CVSS 3.7).
Mitigation
Upgrade to Nokogiri 1.19.5 or later, or do not enable DTDLOAD, DTDVALID or
NOENT for untrusted input.
Credit
This issue was responsibly reported by @arpitjain099.