EUVD-2026-39419Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures the three-step exploitation chain; C:L reflects the potential heap byte leak noted in the advisory and information disclosure tag.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.
AnalysisAI
Use-after-free in Nokogiri's CRuby (libxml2) implementation allows freed heap memory to be read on subsequent calls to Document#encoding, potentially causing a segmentation fault or leaking stale heap bytes into a Ruby String object. Versions prior to 1.19.4 are affected when the three-step exploitation pattern occurs: an invalid encoding assignment, exception rescue, and continued document use. No public exploit has been identified and this vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 1.7 accurately reflects the low real-world priority.
Technical ContextAI
Nokogiri (CPE: cpe:2.3:a:sparklemotion:nokogiri) is a widely used Ruby gem wrapping libxml2 for XML and HTML parsing. The vulnerability is classified as CWE-416 (Use After Free): the C extension's implementation of Document#encoding= frees the libxml2 document's internal encoding C string when an invalid value is passed, but fails to zero out or replace the pointer before raising a Ruby exception. This leaves a dangling pointer in the document's internal state. The next call to Document#encoding then dereferences freed heap memory, which can either trigger a segmentation fault (crashing the Ruby process) or return stale freed bytes as a Ruby String, constituting a partial heap information disclosure. The flaw is specific to the CRuby path because it lives in the C extension; Nokogiri's JRuby implementation uses a Java-based XML stack and does not share this code path.
RemediationAI
Upgrade to Nokogiri 1.19.4 or later; this is the vendor-released patch (confirmed by GHSA-5v8h-3h3q-446p) and requires no changes to application-level public API usage. If an immediate upgrade is not possible, the primary compensating control is to avoid passing attacker-controlled or externally sourced values to Document#encoding= - applications that exclusively assign hardcoded, developer-authored encoding strings to this method are not directly exposed to the vulnerability. Additionally, audit any rescue blocks that catch exceptions from Document#encoding= and continue operating on the same document object; restructuring such code to discard and recreate the document after an encoding error eliminates the dangling-pointer exploitation path without requiring a gem update. The vendor advisory is at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p.
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bu
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenize
Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and pr
Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code
Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today