There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,
    calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null
    byte) raises an exception, but only after freeing the document's current encoding string without replacing
    it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid
    memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2)
    implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4. (CVE-2026-57236)

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the
    NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was
    not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options
    could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE
    attacks. This vulnerability is fixed in 1.19.4. (CVE-2026-57234)

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,
    Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds
    using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used
    at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that
    typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This
    vulnerability is fixed in 1.19.4. (CVE-2026-57235)

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,
    Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes
    that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the
    process. This vulnerability is fixed in 1.19.4. (CVE-2026-57434)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Nokogiri 是 Ruby 编程语言的开源 XML 和 HTML 库。在 1.19.4版本之前的 中，Nokogiri 在继承自 Nokogiri：：XML：：Node 的已分配但未初始化本机封装程序类调用某些方法时包含错误。这导致空指针取消引用，可导致进程崩溃。此漏洞已在 1.19.4 中修复。(CVE-2026-57434)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Nokogiri 是 Ruby 編程語言的開源 XML 和 HTML 庫。在之前 1.19.4，Nokogiri 在繼承自 Nokogiri：：XML：：Node 的已分配但未初始化的原生包裝類別上呼叫某些方法時包含一個錯誤。這會導致 NULL 指標解除參照，進程可能會當機。此弱點已在 1.19.4 中修正。(CVE-2026-57434)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Nokogiri は Ruby プログラミング言語用のオープンソースの XML および HTML ライブラリです。1.19.4より前のバージョンでは、Nokogiri::XML::Nodeから継承する、割り当てられているが初期化されていないネイティブラッパークラスで特定のメソッドを呼び出すときに、Nokogiriにバグがあります。これにより、プロセスをクラッシュさせる可能性がある NULL ポインターデリファレンスが発生しました。この脆弱性は 1.19.4 で修正されました。(CVE-2026-57434)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,     Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes     that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the     process. This vulnerability is fixed in 1.19.4. (CVE-2026-57434)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
478655	Alpine: ruby-nokogiri: security update to 1.19.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/11/8	2026/11/8	medium
478655	Alpine: ruby-nokogiri: security update to 1.19.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/11/8	2026/11/8	medium
323619	Linux Distros 未修补的漏洞：CVE-2026-57434	Nessus	Misc.	2026/6/29	2026/11/6	medium
323619	Linux Distros 未修補弱點：CVE-2026-57434	Nessus	Misc.	2026/6/29	2026/11/6	medium
323619	Linux Distros のパッチ未適用の脆弱性: CVE-2026-57434	Nessus	Misc.	2026/6/29	2026/11/6	medium
324558	Photon OS 5.0: Rubygem PHSA-2026-5.0-0911	Nessus	PhotonOS Local Security Checks	2026/7/1	2026/10/14	medium
323619	Linux Distros Unpatched Vulnerability : CVE-2026-57434	Nessus	Misc.	2026/6/29	2026/11/6	medium
332554	Photon OS 5.0: Rubygem PHSA-2026-5.0-91-0911	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/2	medium
375140	Photon OS 5.0: Rubygem PHSA-2026-5.0-90-1031	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

high