Threats tagged 'ghsa-v995-44v6-5fqm'

A vulnerability in JRuby's XML parsing allows the NONET option to be bypassed for external DTDs and entities when the system identifier uses a short-form IPv4 host or an absolute path in documents parsed from network URLs. This can cause network requests to be sent when parsing untrusted XML with certain options enabled, potentially enabling SSRF. The issue affects Nokogiri versions prior to 1.19.5 and is rated low severity. The vulnerability is fixed in Nokogiri 1.19.5.