Medium4.8Vendor: LowRed Hat Linux

Medium [CVE-2026-57234] Server-Side Request Forgery (SSRF) and XML External Entity (XXE) via improper enforcement of NONET parse option

This medium-severity Red Hat Linux advisory covers CVE-2026-57234.

CVE-2026-57234 Published Jun 25, 2026Updated by vendor Jun 25, 2026

CVE-2026-57234

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation.

As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

This oversight could allow a specially crafted XML schema to fetch external resources over the network, potentially leading to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks. Red Hat products are not affected by this vulnerability.

Red Hat products use the CRuby (MRI) implementation, where NONET is correctly enforced and external resource fetching is properly blocked. Red Hat severity: Low — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N).

Weakness: CWE-611. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Satellite 6 as not affected.

Affected versions

< 1.19.4

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Fixed versions

1.19.4

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.