Is there a patch available for EUVD-2026-39426?

Yes, a patch is available for EUVD-2026-39426. Update the affected software to the latest version immediately.

Nokogiri EUVD-2026-39426

Q: What is the CVSS score of EUVD-2026-39426?

EUVD-2026-39426 has a CVSS 4.0 base score of 1.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-57435 LOW

Use After Free (CWE-416)

2026-06-25 GitHub_M

Information Disclosure Use After Free Memory Corruption Nokogiri Sparklemotion

1.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

1.7 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AV:N retained because Nokogiri processes external input; AC:H reflects the unusual application-code pattern required; only low availability impact, no C or I consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Source Code Evidence Fetched

Jun 25, 2026 - 15:22 vuln.today

Analysis Generated

Jun 25, 2026 - 15:22 vuln.today

DescriptionCVE.org

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

AnalysisAI

Use-after-free in Nokogiri's CRuby native extension (versions prior to 1.19.4) can corrupt process memory or cause a segfault when an application accesses an XML attribute's child node and subsequently replaces that attribute's value via Attr#value= or #content=. The underlying libxml2 wrapper frees the native child node while a Ruby object in the document node cache retains a stale pointer, which a later GC mark pass or direct access can dereference. With a CVSS 4.0 score of 1.7, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to application availability.

Technical ContextAI

Nokogiri wraps libxml2 via a CRuby native C extension and maintains a document node cache that maps live Ruby wrapper objects to their underlying C-layer nodes. CWE-416 (Use After Free) occurs in the attribute-mutation path: when Nokogiri::XML::Attr#value= or #content= replaces an attribute's value, it frees the native child node, but any Ruby wrapper previously obtained via Attr#child or similar accessors remains referenced in the document cache with a now-invalid pointer. A subsequent Ruby garbage-collector mark traversal or explicit use of the stale wrapper dereferences freed memory, producing an invalid read and potentially a segfault. The JRuby implementation uses a pure Java code path and is entirely unaffected. CPE cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:* covers all versions through 1.19.3.

RemediationAI

Upgrade to Nokogiri 1.19.4 or later - vendor-released patch confirmed at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp. The fix preserves any already-wrapped attribute child nodes before replacing the attribute value, eliminating the use-after-free with no change to the public API. Where immediate upgrade is not feasible, audit application code and avoid accessing attribute child nodes via Attr#child or equivalent accessors before calling Attr#value= or #content= on the same attribute. This workaround eliminates the triggering pattern but requires code review for every Nokogiri XML mutation site; the risk of missing an instance makes upgrading strongly preferred.