CVE-2026-79772
Last modified
CVE-2026-79772 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nokogiri | Nokogiri | >= 1.5.1, < 1.19.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-79772?
How severe is CVE-2026-79772?
How do I fix CVE-2026-79772?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7976Use after free in Views in Google Chrome prior to 148.0.7778…7.5
- CVE-2026-79767Gardener implements the automated management and operation o…5.5
- CVE-2026-79769Nokogiri versions before 1.19.4 contain a possible invalid (…5.5
- CVE-2026-7977Inappropriate implementation in Canvas in Google Chrome prio…6.3
- CVE-2026-79770Nokogiri versions before 1.19.3 contain regular expression d…7.5
- CVE-2026-79771Nokogiri versions before 1.19.3 contain a memory leak in the…5.3
- CVE-2026-79773Winter CMS before 1.2.13 contains a local file inclusion vul…4.9
- CVE-2026-79774Winter CMS versions before 1.2.13 contain an incomplete fix …8.4
- CVE-2026-79775rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0)…6.5
- CVE-2026-79776rclone before 1.75.0 mounts the pprof debug handler as its o…5.3
- CVE-2026-79777rclone before v1.75.0 includes full Go stack traces in RC AP…2.7
- CVE-2026-79778rclone before v1.75.0 contains a denial of service vulnerabi…5.3
Are you affected by CVE-2026-79772?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST