Nokogiri EUVD-2026-39422

Exploitation requires that the target Ruby application pass an attacker-controlled integer directly to Nokogiri::XML::NodeSet#[] or #slice without first validating it against node_set.length. The crafted value must be a large negative integer whose 32-bit truncation wraps into the apparent in-bounds range while its full 64-bit representation indexes far outside the node set's allocated storage. On JRuby, no memory-unsafe condition is triggered regardless of the input - only CRuby (MRI Ruby) runtimes are subject to the out-of-bounds read, process crash, and potential heap disclosure. Applications that do not pass untrusted external data as a NodeSet index, or that pre-validate indices before use, are not exploitable. The CVSS AT:P metric explicitly encodes this application-level prerequisite as a required attack condition.

The CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N) is broadly consistent with the technical evidence. The AT:P metric (Attack Requirements: Present) is the critical risk-limiting factor: exploitation depends entirely on the target application forwarding untrusted integer input to NodeSet#[] without prior validation, which is a non-trivial application-level prerequisite not present in the majority of Nokogiri consumers. No EPSS score was provided in the input data; no CISA KEV listing exists; and no public exploit code has been identified, making this a medium-priority finding rather than an emergency. The primary real-world impact is denial of service via process crash on CRuby; confidentiality impact (potential heap memory disclosure) is present but secondary and depends on an attacker's ability to observe output or timing. Integrity is not affected. JRuby deployments face no memory-safety risk. The vendor rates this medium severity, consistent with this assessment. The key takeaway: if your Ruby application indexes Nokogiri NodeSets with externally supplied integers, this is a genuine DoS and potential information-disclosure risk requiring prompt patching; if not, exposure is negligible.

An attacker submits a crafted large negative integer - for instance via a web API parameter, URL segment, or user-supplied form field - that a Ruby application passes without validation as an index into a Nokogiri NodeSet. On CRuby, the 32-bit-truncated bounds check passes, but the full 64-bit index dereferences memory far outside the node set buffer, crashing the Ruby process and potentially exposing adjacent heap contents to an observer. No public exploit code has been identified; the scenario requires the application to expose this specific integer-to-NodeSet#[] code path to untrusted input.