CVE-2026-79772 Nokogiri before 1.19.1 Unchecked Return Value canonicalize
Attackers can bypass SAML signature validation by exploiting unchecked return values in Nokogiri's canonicalization method, accepting invalid XML as valid.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79772?
CVE-2026-79772 is a medium-severity vulnerability in sparklemotion nokogiri, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
Weakness: CWE-252
Which versions are affected by CVE-2026-79772?
2 open source packages ship an affected version, including nokogiri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | From 1.5.1 | 1.19.1 |
nokogiri RubyGems | From 1.5.1 | 1.19.1 |
Products include Nokogiri Nokogiri.
How do I fix CVE-2026-79772?
Upgrade nokogiri to 1.19.1 or later.
Is CVE-2026-79772 being exploited?
There is no known exploitation of CVE-2026-79772 in the wild and no public exploit code.
Other vulnerabilities in sparklemotion nokogiri
- CVE-2026-79770 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
- CVE-2022-23476 Unchecked return value from xmlTextReaderExpand in Nokogiri
- CVE-2021-41098 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
- CVE-2012-6685 Nokogiri is vulnerable to XML External Entity (XXE) attack
- CVE-2026-79771 Nokogiri before 1.19.3 Memory Leak via XSLT Transform
Sources
Also known as BELL-CVE-2026-79772, CLEANSTART-2026-YY44822, DEBIAN-CVE-2026-79772, GHSA-wx95-c6cv-8532, MINI-4549-7qmf-g294, MINI-5chf-488p-2rvj and 7 more.