GHSA-rh9x-7xjc-vwx2

Duplicate Advisory: Nokogiri XSLT transform has a memory leak

Published

2026-08-25

Modified

2026-09-02

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v2fc-qm4h-8hqv. This link is maintained to preserve external references. ## Original Description Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-rh9x-7xjc-vwx2