<![CDATA[RubySec]]>2026-07-14T16:24:55+00:00https://rubysec.com/Jekyll<![CDATA[CVE-2026-38969 (webrick): ruby webrick through v1.9.2 WEBrick reparses trailer]]>https://rubysec.com/advisories/CVE-2026-389692026-07-02T00:00:00+00:00<![CDATA[GHSA-mjgf-xj26-9qf9 (pay): pay-rails/pay - non-constant-time HMAC comparison in Paddle Billing webhook signature verifier]]>https://rubysec.com/advisories/GHSA-mjgf-xj26-9qf92026-07-01T00:00:00+00:00<![CDATA[CVE-2026-54696 (json): JSON generator heap buffer overflow when streaming to an IO]]>https://rubysec.com/advisories/CVE-2026-546962026-06-30T00:00:00+00:00<![CDATA[CVE-2026-44161 (fluentd): Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`]]>https://rubysec.com/advisories/CVE-2026-441612026-06-26T00:00:00+00:00<![CDATA[CVE-2026-44160 (fluentd): Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`]]>https://rubysec.com/advisories/CVE-2026-441602026-06-26T00:00:00+00:00<![CDATA[CVE-2026-44025 (fluentd): Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API]]>https://rubysec.com/advisories/CVE-2026-440252026-06-26T00:00:00+00:00<![CDATA[CVE-2026-44024 (fluentd): Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder]]>https://rubysec.com/advisories/CVE-2026-440242026-06-26T00:00:00+00:00<![CDATA[GHSA-wwpr-jff3-395c (crass): A large number of adjacent CSS comments can trigger a SystemStackError]]>https://rubysec.com/advisories/GHSA-wwpr-jff3-395c2026-06-25T00:00:00+00:00<![CDATA[GHSA-8vfg-2r28-hvhj (crass): Non-ASCII characters cause superlinear CPU consumption]]>https://rubysec.com/advisories/GHSA-8vfg-2r28-hvhj2026-06-25T00:00:00+00:00<![CDATA[GHSA-6wmf-3r64-vcwv (crass): Large numeric exponents cause CPU and memory denial of service]]>https://rubysec.com/advisories/GHSA-6wmf-3r64-vcwv2026-06-25T00:00:00+00:00<![CDATA[GHSA-6jxj-px6v-747w (crass): Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage]]>https://rubysec.com/advisories/GHSA-6jxj-px6v-747w2026-06-25T00:00:00+00:00<![CDATA[CVE-2026-44163 (fluent-plugin-opentelemetry): fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`]]>https://rubysec.com/advisories/CVE-2026-441632026-06-25T00:00:00+00:00<![CDATA[CVE-2026-44162 (fluent-plugin-s3): fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`]]>https://rubysec.com/advisories/CVE-2026-441622026-06-25T00:00:00+00:00<![CDATA[GHSA-2x63-gw47-w4mm (websocket-driver): Denial of service via malformed Host header]]>https://rubysec.com/advisories/GHSA-2x63-gw47-w4mm2026-06-23T00:00:00+00:00<![CDATA[CVE-2026-49342 (yard): YARD static cache reads raw traversal paths before router sanitization]]>https://rubysec.com/advisories/CVE-2026-493422026-06-23T00:00:00+00:00<![CDATA[GHSA-wjv4-x9w8-wm3h (nokogiri): Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type]]>https://rubysec.com/advisories/GHSA-wjv4-x9w8-wm3h2026-06-19T00:00:00+00:00<![CDATA[GHSA-wfpw-mmfh-qq69 (nokogiri): Nokogiri: Possible Use-After-Free in XInclude Processing]]>https://rubysec.com/advisories/GHSA-wfpw-mmfh-qq692026-06-19T00:00:00+00:00` in place, freeing the include node along with its children
(such as `` and its descendants) and any namespaces declared on
them. If an application had already exposed one of those nodes or namespaces
to Ruby, the corresponding Ruby object was left pointing at freed memory.
Using the object could result in invalid reads or writes to memory.
Nokogiri 1.19.4 substitutes each `` on a defensive copy by
default, so the structures libxml2 frees are never the ones bound to live Ruby
objects.
Only the CRuby implementation is affected; JRuby is not affected.
### Severity
The Nokogiri maintainers have evaluated this as low severity. Reaching it
requires an unusual API-usage pattern that does not arise during normal use.
The application must parse a document without XInclude, traverse into an
`` subtree to expose its nodes or namespaces to Ruby, and only
then invoke XInclude processing. The common case, requesting XInclude at parse
time, operates on a freshly parsed document whose nodes are not yet exposed to
Ruby and is not affected. Nokogiri 1.19.4 makes this pattern safe by default
and requires no change to application code.
### Mitigation
Upgrade to Nokogiri 1.19.4 or later.
As a workaround for earlier versions, perform XInclude substitution at parse
time (with the `xinclude` parse option) rather than calling `#do_xinclude` on
a document that has already been traversed. A freshly parsed document has no
nodes exposed to Ruby, so the substitution is safe.
### Credit
This issue was responsibly reported by Zheng Yu from depthfirst.com.]]><![CDATA[GHSA-phwj-rprq-35pp (nokogiri): Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`]]>https://rubysec.com/advisories/GHSA-phwj-rprq-35pp2026-06-19T00:00:00+00:00<![CDATA[GHSA-p67v-3w7g-wjg7 (nokogiri): Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime]]>https://rubysec.com/advisories/GHSA-p67v-3w7g-wjg72026-06-19T00:00:00+00:00<![CDATA[GHSA-mqq5-j7w8-2hgh (alchemy_cms): AlchemyCMS - Unauthenticated nested page API leaks restricted and unpublished content]]>https://rubysec.com/advisories/GHSA-mqq5-j7w8-2hgh2026-06-19T00:00:00+00:00