Medium [CVE-2026-57437] Denial of Service due to improper XPathContext garbage collection
This medium-severity Red Hat Linux advisory covers CVE-2026-57437 affecting Red Hat 3scale API Management Platform 2, Red Hat Satellite 6.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection.
If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context.
The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.
An attacker could potentially exploit this by causing the application to read invalid memory, leading to a denial of service (DoS) through a segmentation fault. Red Hat rates this flaw as Low impact, consistent with the upstream maintainers' assessment.
This is purely an application-level code pattern issue, not an externally exploitable vulnerability. Red Hat severity: Low — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-771. Affected Red Hat products: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6.
Red Hat does not currently list a fixing RHSA for this CVE.
- < 1.19.4
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Mitigation checklist
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.