CVE-2026-79772
Received Received - Intake

Nokogiri XML Canonicalization Signature Bypass

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79772
EUVD
EUVD-2026-65530

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sparklemotion nokogiri From 1.5.1 (inc) to 1.19.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nokogiri versions before 1.19.1 have a flaw where the canonicalize method does not properly check if canonicalization fails. Instead of raising an exception, it returns an empty string. This allows attackers to provide invalid XML that appears valid, potentially bypassing signature checks in downstream libraries like SAML.

Detection Guidance

Check Nokogiri version with command: gem list nokogiri. If version is below 1.19.1, the system is vulnerable. Inspect SAML libraries for improper canonicalization handling.

Impact Analysis

This vulnerability could allow attackers to bypass security checks by providing malformed XML that is incorrectly accepted as valid. This may lead to unauthorized access or data tampering if used in systems relying on SAML or similar XML-based authentication.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing attackers to bypass signature validation in SAML libraries. This may lead to unauthorized access or data tampering, which are critical concerns under these regulations.

Mitigation Strategies

Upgrade Nokogiri to version 1.19.1 or later using gem update nokogiri. Review SAML library integrations for signature validation bypass risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79772. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart