Skip to content
Heist/ feed
Back to feed
Medium

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Type: advisorySources: OSV

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-79772
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 01:15 UTC · Revision 1

Source evidence

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

core-osv · Original source

Published 25 Aug 2026, 15:16 UTC

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

osv:CVE-2026-79772
Complete source record
{
  "id": "7c924a9ebd26c65506bc56e8c2ef1f0db394790fb2449fa7bef1fa0c6510292b",
  "url": "https://osv.dev/vulnerability/CVE-2026-79772",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
    "summary": "Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.",
    "evidence": "osv:CVE-2026-79772",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-79772",
      "aliases": [
        "CVE-2026-79772",
        "GHSA-wx95-c6cv-8532"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/sparklemotion/nokogiri",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8c253d20421a597c0c77bf42227258bc8d258193"
                },
                {
                  "fixed": "d9130457369de8a6efcb764e6da2cb80d5d3b6dd"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "1.5.1"
                      },
                      {
                        "fixed": "1.19.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "cpe": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*",
                    "range": [
                      {
                        "introduced": "1.5.1"
                      },
                      {
                        "fixed": "1.19.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.19.0",
            "v1.18.10",
            "v1.18.9",
            "v1.18.8",
            "v1.18.7",
            "v1.18.6",
            "v1.18.5",
            "v1.18.4",
            "v1.18.3",
            "v1.18.2",
            "v1.18.1",
            "v1.18.0",
            "v1.18.0.rc1",
            "v1.17.0",
            "v1.16.0",
            "v1.16.0.rc1",
            "v1.15.2",
            "v1.15.1",
            "v1.15.0",
            "v1.14.1",
            "v1.14.0",
            "v1.14.0.rc1",
            "v1.13.0",
            "v1.12.3",
            "v1.12.2",
            "v1.12.1",
            "v1.12.0",
            "v1.12.0.rc1",
            "v1.11.3",
            "v1.11.2",
            "v1.11.1",
            "v1.11.0",
            "v1.11.0.rc4",
            "v1.11.0.rc3",
            "v1.11.0.rc2",
            "v1.11.0.rc1",
            "v1.10.3",
            "v1.10.2",
            "v1.8.5",
            "v1.10.1",
            "v1.10.0",
            "v1.10.0.rc1",
            "v1.9.1",
            "v1.9.0",
            "v1.9.0.rc1",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.0.1",
            "v1.7.0",
            "v1.6.8",
            "v1.6.8.rc3",
            "v1.6.8.rc2",
            "v1.6.8.rc1",
            "v1.6.7.rc4",
            "v1.6.6.2",
            "v1.6.7.rc3",
            "v1.6.7.rc2",
            "v1.6.7.rc1",
            "1.7.0.1-linux-binary1",
            "v1.6.6.1",
            "v1.6.6",
            "v1.6.5",
            "v1.6.4",
            "v1.6.3.1",
            "v1.6.3",
            "v1.6.3.rc3",
            "v1.6.3.rc2",
            "v1.6.3.rc1",
            "v1.6.2.1",
            "v1.6.2",
            "v1.6.2.rc3",
            "v1.6.2.rc1",
            "v1.6.2.beta.1",
            "v1.6.0",
            "v1.5.9",
            "v1.6.0.rc1",
            "v1.5.8",
            "v1.5.7",
            "v1.5.7.rc3",
            "v1.5.7.rc2",
            "v1.5.7.rc1",
            "v1.5.6",
            "v1.5.6.rc2",
            "v1.5.5.rc2",
            "v1.5.5.rc1",
            "v1.5.4.rc3",
            "v1.5.4.rc2",
            "v1.5.4.rc1",
            "v1.5.3",
            "v1.5.3.rc6",
            "v1.5.3.rc5",
            "v1.5.3.rc4",
            "v1.5.3.rc3",
            "v1.5.3.rc1",
            "v1.5.2",
            "v1.5.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79772.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.058136046Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79772.json",
        "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-79772",
        "https://www.vulncheck.com/advisories/nokogiri-before-unchecked-return-value-canonicalize"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-252"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79772.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-79772",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 491514,
  "published_at": "2026-08-25T15:16:04.4+00:00"
}