[From nobody Mon Jun 29 01:49:05 2026
Received: (at submit) by bugs.debian.org; 26 Jun 2026 04:15:04 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA,
 FROMDEVELOPER, 
 NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 62; hammy, 150; neutral, 194; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug,
 0.000-+--H*Ad:N*Tracking
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wcxy4-008onW-18
 for submit@bugs.debian.org; Fri, 26 Jun 2026 04:15:04 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: ruby-nokogiri: CVE-2026-57234 CVE-2026-57235 CVE-2026-57236
 CVE-2026-57434 CVE-2026-57435 CVE-2026-57436 CVE-2026-57437 CVE-2026-57438
Message-ID: <178244730339.2060772.18092334016708837878.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0+nmu1
Date: Fri, 26 Jun 2026 06:15:03 +0200
Delivered-To: submit@bugs.debian.org

U291cmNlOiBydWJ5LW5va29naXJpClZlcnNpb246IDEuMTkuMytkZnNnLTEKU2V2ZXJpdHk6IGdy
YXZlClRhZ3M6IHNlY3VyaXR5IHVwc3RyZWFtCkp1c3RpZmljYXRpb246IHVzZXIgc2VjdXJpdHkg
aG9sZQpYLURlYmJ1Z3MtQ2M6IGNhcm5pbEBkZWJpYW4ub3JnLCBEZWJpYW4gU2VjdXJpdHkgVGVh
bSA8dGVhbUBzZWN1cml0eS5kZWJpYW4ub3JnPgoKSGksCgpUaGUgZm9sbG93aW5nIHZ1bG5lcmFi
aWxpdGllcyB3ZXJlIHB1Ymxpc2hlZCBmb3IgcnVieS1ub2tvZ2lyaS4KCkNWRS0yMDI2LTU3MjM0
WzBdOgp8IE5va29naXJpIGlzIGFuIG9wZW4gc291cmNlIFhNTCBhbmQgSFRNTCBsaWJyYXJ5IGZv
ciB0aGUgUnVieQp8IHByb2dyYW1taW5nIGxhbmd1YWdlLiBQcmlvciB0byAxLjE5LjQsIHRoZSBO
T05FVCBwYXJzZSBvcHRpb24sIHdoaWNoCnwgTm9rb2dpcmkgdHVybnMgb24gYnkgZGVmYXVsdCBm
b3IgTm9rb2dpcmk6OlhNTDo6U2NoZW1hIChzZWUKfCBDVkUtMjAyMC0yNjI0NyksIHdhcyBub3Qg
Y29ycmVjdGx5IGVuZm9yY2VkIG9uIHRoZSBKUnVieQp8IGltcGxlbWVudGF0aW9uLiBBcyBhIHJl
c3VsdCwgYSBzY2hlbWEgcGFyc2VkIHdpdGggZGVmYXVsdCBvcHRpb25zCnwgY291bGQgc3RpbGwg
Y2F1c2UgZXh0ZXJuYWwgcmVzb3VyY2VzIHRvIGJlIGZldGNoZWQgb3ZlciB0aGUgbmV0d29yaywK
fCBwb3RlbnRpYWxseSBlbmFibGluZyBTU1JGIG9yIFhYRSBhdHRhY2tzLiBUaGlzIHZ1bG5lcmFi
aWxpdHkgaXMKfCBmaXhlZCBpbiAxLjE5LjQuCgoKQ1ZFLTIwMjYtNTcyMzVbMV06CnwgTm9rb2dp
cmkgaXMgYW4gb3BlbiBzb3VyY2UgWE1MIGFuZCBIVE1MIGxpYnJhcnkgZm9yIHRoZSBSdWJ5Cnwg
cHJvZ3JhbW1pbmcgbGFuZ3VhZ2UuIFByaW9yIHRvIDEuMTkuNCwgTm9rb2dpcmk6OlhNTDo6Tm9k
ZVNldCNbXQp8IChhbmQgaXRzIGFsaWFzICNzbGljZSkgY2hlY2tlZCB0aGUgcmVxdWVzdGVkIGlu
ZGV4IGFnYWluc3QgdGhlIG5vZGUKfCBzZXQncyBib3VuZHMgdXNpbmcgYSAzMi1iaXQtdHJ1bmNh
dGVkIGNvcHkgb2YgdGhlIGluZGV4LiBBIGxhcmdlCnwgbmVnYXRpdmUgaW5kZXggY291bGQgcGFz
cyB0aGUgY2hlY2sgYW5kIHRoZW4gYmUgdXNlZCBhdCBmdWxsIHdpZHRoLAp8IHJlYWRpbmcgb3V0
c2lkZSB0aGUgbm9kZSBzZXQncyBzdG9yYWdlLiBPbiBDUnVieSB0aGlzIGlzIGFuIG91dC1vZi0K
fCBib3VuZHMgcmVhZCB0aGF0IHR5cGljYWxseSBjcmFzaGVzIHRoZSBwcm9jZXNzOyBvbiBKUnVi
eSBpdCBpcyBub3QKfCBtZW1vcnktdW5zYWZlIGJ1dCByZXR1cm5zIGFuIGluY29ycmVjdCBub2Rl
LiBUaGlzIHZ1bG5lcmFiaWxpdHkgaXMKfCBmaXhlZCBpbiAxLjE5LjQuCgoKQ1ZFLTIwMjYtNTcy
MzZbMl06CnwgTm9rb2dpcmkgaXMgYW4gb3BlbiBzb3VyY2UgWE1MIGFuZCBIVE1MIGxpYnJhcnkg
Zm9yIHRoZSBSdWJ5CnwgcHJvZ3JhbW1pbmcgbGFuZ3VhZ2UuIFByaW9yIHRvIDEuMTkuNCwgY2Fs
bGluZyBEb2N1bWVudCNlbmNvZGluZz0KfCB3aXRoIGFuIGludmFsaWQgZW5jb2RpbmcgKGUuZy4s
IGEgbm9uLXN0cmluZywgb3IgYSBzdHJpbmcgY29udGFpbmluZwp8IGEgbnVsbCBieXRlKSByYWlz
ZXMgYW4gZXhjZXB0aW9uLCBidXQgb25seSBhZnRlciBmcmVlaW5nIHRoZQp8IGRvY3VtZW50J3Mg
Y3VycmVudCBlbmNvZGluZyBzdHJpbmcgd2l0aG91dCByZXBsYWNpbmcgaXQuIFRoZQp8IGRvY3Vt
ZW50IGlzIGxlZnQgcmVmZXJlbmNpbmcgZnJlZWQgbWVtb3J5LCBzbyB0aGUgbmV4dCBjYWxsIHRv
CnwgRG9jdW1lbnQjZW5jb2RpbmcgcmVhZHMgaW52YWxpZCBtZW1vcnksIHdoaWNoIGNhbiBjYXVz
ZSBhIHNlZ2ZhdWx0Cnwgb3IgbGVhayBmcmVlZCBieXRlcyBpbnRvIGEgUnVieSBTdHJpbmcuIEFm
ZmVjdHMgdGhlIENSdWJ5IChsaWJ4bWwyKQp8IGltcGxlbWVudGF0aW9uIG9ubHk7IEpSdWJ5IGlz
IG5vdCBhZmZlY3RlZC4gVGhpcyB2dWxuZXJhYmlsaXR5IGlzCnwgZml4ZWQgaW4gMS4xOS40LgoK
CkNWRS0yMDI2LTU3NDM0WzNdOgp8IE5va29naXJpIGlzIGFuIG9wZW4gc291cmNlIFhNTCBhbmQg
SFRNTCBsaWJyYXJ5IGZvciB0aGUgUnVieQp8IHByb2dyYW1taW5nIGxhbmd1YWdlLiBQcmlvciB0
byAxLjE5LjQsIE5va29naXJpIGNvbnRhaW5zIGEgYnVnIHdoZW4KfCBjYWxsaW5nIGNlcnRhaW4g
bWV0aG9kcyBvbiBhbGxvY2F0ZWQtYnV0LXVuaW5pdGlhbGl6ZWQgbmF0aXZlCnwgd3JhcHBlciBj
bGFzc2VzIHRoYXQgaW5oZXJpdCBmcm9tIE5va29naXJpOjpYTUw6Ok5vZGUuIFRoaXMgY2F1c2Vk
IGEKfCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2UgdGhhdCBjb3VsZCBjcmFzaCB0aGUgcHJvY2Vz
cy4gVGhpcwp8IHZ1bG5lcmFiaWxpdHkgaXMgZml4ZWQgaW4gMS4xOS40LgoKCkNWRS0yMDI2LTU3
NDM1WzRdOgp8IE5va29naXJpIGlzIGFuIG9wZW4gc291cmNlIFhNTCBhbmQgSFRNTCBsaWJyYXJ5
IGZvciB0aGUgUnVieQp8IHByb2dyYW1taW5nIGxhbmd1YWdlLiBQcmlvciB0byAxLjE5LjQsIE5v
a29naXJp4oCZcyBDUnVieSBuYXRpdmUKfCBleHRlbnNpb24gY291bGQgbGVhdmUgYSBSdWJ5IHdy
YXBwZXIgcG9pbnRpbmcgdG8gZnJlZWQgbWVtb3J5IHdoZW4KfCByZXBsYWNpbmcgdGhlIHZhbHVl
IG9mIGFuIFhNTCBhdHRyaWJ1dGUuIElmIFJ1YnkgY29kZSBoYWQgYWxyZWFkeQp8IGFjY2Vzc2Vk
IGFuIGF0dHJpYnV0ZSBjaGlsZCBub2RlLCBOb2tvZ2lyaTo6WE1MOjpBdHRyI3ZhbHVlPSBjb3Vs
ZAp8IGZyZWUgdGhlIHVuZGVybHlpbmcgbmF0aXZlIGNoaWxkIG5vZGUgd2hpbGUgdGhlIHdyYXBw
ZXIgcmVtYWluZWQKfCByZWFjaGFibGUgdGhyb3VnaCB0aGUgZG9jdW1lbnQgbm9kZSBjYWNoZS4g
QSBsYXRlciB1c2Ugb2YgdGhlIGZyZWVkCnwgY2hpbGQgbm9kZSBvciBhIFJ1YnkgR0MgbWFyayBj
b3VsZCBkZXJlZmVyZW5jZSBhbiBpbnZhbGlkIHBvaW50ZXIsCnwgY2F1c2luZyBhbiBpbnZhbGlk
IHJlYWQgYW5kIGEgcG9zc2libGUgc2VnZmF1bHQuIFRoaXMgdnVsbmVyYWJpbGl0eQp8IGlzIGZp
eGVkIGluIDEuMTkuNC4KCgpDVkUtMjAyNi01NzQzNls1XToKfCBOb2tvZ2lyaSBpcyBhbiBvcGVu
IHNvdXJjZSBYTUwgYW5kIEhUTUwgbGlicmFyeSBmb3IgdGhlIFJ1YnkKfCBwcm9ncmFtbWluZyBs
YW5ndWFnZS4gUHJpb3IgdG8gMS4xOS40LCBOb2tvZ2lyaTo6WE1MOjpEb2N1bWVudCNyb290PQp8
IHZhbGlkYXRlZCBvbmx5IHRoYXQgdGhlIG5ldyByb290IHdhcyBhIE5va29naXJpOjpYTUw6Ok5v
ZGUsIGFsbG93aW5nCnwgYSBEVEQgbm9kZSB0byBiZSBzZXQgYXMgdGhlIGRvY3VtZW50IHJvb3Qu
IFRoZSByZXN1bHQgaXMgYSBoZWFwIHVzZS0KfCBhZnRlci1mcmVlIGR1cmluZyBnYXJiYWdlIGNv
bGxlY3Rpb24gb3IgZmluYWxpemF0aW9uLCBsZWFkaW5nIHRvIGFuCnwgaW52YWxpZCBtZW1vcnkg
cmVhZCBvciBwb3RlbnRpYWxseSBhIHNlZ2ZhdWx0LiBUaGlzIHZ1bG5lcmFiaWxpdHkgaXMKfCBm
aXhlZCBpbiAxLjE5LjQuCgoKQ1ZFLTIwMjYtNTc0MzdbNl06CnwgTm9rb2dpcmkgaXMgYW4gb3Bl
biBzb3VyY2UgWE1MIGFuZCBIVE1MIGxpYnJhcnkgZm9yIHRoZSBSdWJ5CnwgcHJvZ3JhbW1pbmcg
bGFuZ3VhZ2UuIFByaW9yIHRvIDEuMTkuNCwgTm9rb2dpcmk6OlhNTDo6WFBhdGhDb250ZXh0Cnwg
ZGlkIG5vdCBrZWVwIGl0cyBzb3VyY2UgZG9jdW1lbnQgYWxpdmUgZm9yIGdhcmJhZ2UgY29sbGVj
dGlvbi4gSWYgYW4KfCBYUGF0aENvbnRleHQgb3V0bGl2ZWQgaXRzIGRvY3VtZW50IGFuZCB0aGUg
ZG9jdW1lbnQgd2FzIGNvbGxlY3RlZCwKfCBldmFsdWF0aW5nIGFuIFhQYXRoIGV4cHJlc3Npb24g
Y291bGQgcmVhZCBpbnZhbGlkIG1lbW9yeSBhbmQKfCBwb3RlbnRpYWxseSBzZWdmYXVsdC4gVGhp
cyBpcyBvbmx5IHJlYWNoYWJsZSB3aGVuIGFwcGxpY2F0aW9uIGNvZGUKfCBjb25zdHJ1Y3RzIGFu
IFhQYXRoQ29udGV4dCBkaXJlY3RseSBhbmQgbGV0cyB0aGUgZG9jdW1lbnQgYmVjb21lCnwgdW5y
ZWFjaGFibGUgd2hpbGUgY29udGludWluZyB0byB1c2UgdGhlIGNvbnRleHQuIFRoZSBub3JtYWwK
fCBEb2N1bWVudCN4cGF0aCwgI2NzcywgYW5kIHJlbGF0ZWQgc2VhcmNoIG1ldGhvZHMgYXJlIG5v
dCBhZmZlY3RlZCwKfCBhbmQgaXQgaXMgbm90IHRyaWdnZXJhYmxlIGJ5IG1hbGljaW91cyBkb2N1
bWVudCBpbnB1dC4gVGhpcwp8IHZ1bG5lcmFiaWxpdHkgaXMgZml4ZWQgaW4gMS4xOS40LgoKCkNW
RS0yMDI2LTU3NDM4WzddOgp8IE5va29naXJpIGlzIGFuIG9wZW4gc291cmNlIFhNTCBhbmQgSFRN
TCBsaWJyYXJ5IGZvciB0aGUgUnVieQp8IHByb2dyYW1taW5nIGxhbmd1YWdlLiBQcmlvciB0byAx
LjE5LjQsIFhJbmNsdWRlIHN1YnN0aXR1dGlvbgp8IHBlcmZvcm1lZCBieSBOb2tvZ2lyaTo6WE1M
OjpOb2RlI2RvX3hpbmNsdWRlIHJlcGxhY2VkIGVhY2gKfCA8eGk6aW5jbHVkZT4gaW4gcGxhY2Us
IGZyZWVpbmcgdGhlIGluY2x1ZGUgbm9kZSBhbG9uZyB3aXRoIGl0cwp8IGNoaWxkcmVuIChzdWNo
IGFzIDx4aTpmYWxsYmFjaz4gYW5kIGl0cyBkZXNjZW5kYW50cykgYW5kIGFueQp8IG5hbWVzcGFj
ZXMgZGVjbGFyZWQgb24gdGhlbS4gSWYgYW4gYXBwbGljYXRpb24gaGFkIGFscmVhZHkgZXhwb3Nl
ZAp8IG9uZSBvZiB0aG9zZSBub2RlcyBvciBuYW1lc3BhY2VzIHRvIFJ1YnksIHRoZSBjb3JyZXNw
b25kaW5nIFJ1YnkKfCBvYmplY3Qgd2FzIGxlZnQgcG9pbnRpbmcgYXQgZnJlZWQgbWVtb3J5LiBV
c2luZyB0aGUgb2JqZWN0IGNvdWxkCnwgcmVzdWx0IGluIGludmFsaWQgcmVhZHMgb3Igd3JpdGVz
IHRvIG1lbW9yeS4gVGhpcyB2dWxuZXJhYmlsaXR5IGlzCnwgZml4ZWQgaW4gMS4xOS40LgoKCklm
IHlvdSBmaXggdGhlIHZ1bG5lcmFiaWxpdGllcyBwbGVhc2UgYWxzbyBtYWtlIHN1cmUgdG8gaW5j
bHVkZSB0aGUKQ1ZFIChDb21tb24gVnVsbmVyYWJpbGl0aWVzICYgRXhwb3N1cmVzKSBpZHMgaW4g
eW91ciBjaGFuZ2Vsb2cgZW50cnkuCgpGb3IgZnVydGhlciBpbmZvcm1hdGlvbiBzZWU6CgpbMF0g
aHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUtMjAyNi01NzIz
NAogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIwMjYtNTcyMzQKWzFd
IGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNrZXIvQ1ZFLTIwMjYtNTcy
MzUKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNWRS0yMDI2LTU3MjM1Clsy
XSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90cmFja2VyL0NWRS0yMDI2LTU3
MjM2CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUtMjAyNi01NzIzNgpb
M10gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUtMjAyNi01
NzQzNAogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIwMjYtNTc0MzQK
WzRdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNrZXIvQ1ZFLTIwMjYt
NTc0MzUKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNWRS0yMDI2LTU3NDM1
Cls1XSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90cmFja2VyL0NWRS0yMDI2
LTU3NDM2CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUtMjAyNi01NzQz
NgpbNl0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUtMjAy
Ni01NzQzNwogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIwMjYtNTc0
MzcKWzddIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNrZXIvQ1ZFLTIw
MjYtNTc0MzgKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNWRS0yMDI2LTU3
NDM4CgpSZWdhcmRzLApTYWx2YXRvcmUK
]