Technical impact
Nokogiri versions before 1.19.3 leak memory when processing Ruby strings that contain null bytes through the XSLT Stylesheet transform method. The leak occurs because heap allocations are not released, which can drain available memory after repeated transformations. An attacker who supplies a crafted input containing null bytes to the transform parameters can trigger the leak and cause the application process to run out of memory, ultimately resulting in a denial‑of‑service for long‑running services. This vulnerability is a classic example of CWE-401, a memory leak flaw, and CWE-770, a large or arbitrary allocation flaw.
Affected Systems
Sparklemotion’s Nokogiri library, versions earlier than 1.19.3, is affected. Systems that include these versions and invoke XSLT transforms on user‑supplied strings that may contain null characters are at risk.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity, mainly impacting availability. The EPSS score is 0.00304 (<1%), and the issue is not listed in CISA KEV. An attacker can exploit the flaw by supplying a crafted input to the transform method, which is likely to occur in a Ruby application that accepts external data for XSLT processing. The attack is limited to environments where the attacker can influence the transform parameters, making it an application‑level attack rather than a network‑level vector.
Github GHSA