Nokogiri EUVD-2026-39426

Three specific conditions must all be true simultaneously: (1) the deployment uses the CRuby native extension - JRuby is not affected; (2) application code accesses an XML attribute's child node via Attr#child or a similar accessor, creating a Ruby wrapper retained in the document node cache; and (3) the same application code subsequently calls Attr#value= or #content= on that same attribute, triggering the native free. Nokogiri maintainers confirm this combination does not arise during normal XML processing and is limited to unusual, direct attribute-child-node manipulation patterns. Exploitation is further bounded to availability impact only - a crash or invalid read - with no path to confidentiality or integrity compromise. The AV:N in the CVSS vector reflects that Nokogiri commonly processes network-supplied XML, but the triggering code sequence must be present in application logic, not purely in attacker-controlled input.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U) yields a score of 1.7, accurately capturing that impact is limited to a potential availability disruption with zero confidentiality or integrity consequence. The AT:P (attack requirements present) modifier is the decisive limiting factor: the application must first access an attribute child node and then mutate that same attribute, a pattern the Nokogiri maintainers explicitly characterize as unusual and absent from normal use. The E:U (exploit unreported) supplemental metric aligns with the absence of any KEV listing or POC. No EPSS score was provided in source data; exploitation probability is inferred as very low from these combined signals. This is a genuine low-severity issue - not a case of high CVSS masking low real risk, but a vulnerability whose CVSS accurately reflects limited blast radius. The primary operational concern is unexpected process crashes in applications that happen to exercise the unusual API pattern, not attacker-controlled code execution or data exfiltration.

An application processing externally supplied XML that first reads an attribute's child node (e.g., attr.child to inspect text structure) and then replaces the attribute's value in the same code path triggers the freed-pointer condition. If the Ruby GC runs before the next use of the stale wrapper, the process segfaults, causing a denial-of-service crash. No public exploit code exists at time of analysis, and reproduction requires application-controlled code rather than purely attacker-supplied input.