What is the CVSS score of EUVD-2026-39428?

EUVD-2026-39428 has a CVSS 4.0 base score of 1.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-39428?

Yes, a patch is available for EUVD-2026-39428. Update the affected software to the latest version immediately.

Nokogiri EUVD-2026-39428

| CVE-2026-57437 LOW

Use After Free (CWE-416)

2026-06-25 GitHub_M

Information Disclosure Use After Free Memory Corruption Nokogiri Sparklemotion

1.7

CVSS 4.0 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Application directly constructs XPathContext from document
Delivery

Document variable falls out of scope
Exploit

Ruby GC collects and frees document memory
Execution

Application invokes XPathContext to evaluate XPath
Persist

C extension dereferences freed document pointer
Impact

Process segfaults

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires two simultaneous application-level conditions: (1) the application code must directly instantiate `Nokogiri::XML::XPathContext` rather than using the standard `Document#xpath`, `#css`, or `#search` methods, and (2) the source document object must become unreachable and be freed by Ruby's garbage collector while the XPathContext is still held and later invoked. This vulnerability cannot be triggered by malicious XML or HTML content supplied to the parser. The standard document search methods already maintain a live document reference and are completely unaffected. Additionally, only the CRuby (MRI) runtime is affected; JRuby deployments of Nokogiri are not vulnerable regardless of API usage pattern.
Impact	The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear scores 1.7, and the AT:P (specific attack requirements) metric accurately captures the non-default API pattern necessary to reach the vulnerable code path. There is no confidentiality or integrity impact - only a low availability impact (VA:L) in the form of a potential application segfault. No EPSS score was provided; given the restrictive triggering conditions and E:U (no known exploit), exploitation probability is inferred to be negligible. This is not in CISA KEV. The Nokogiri maintainers themselves evaluated this as low severity. This is best characterized as a library hardening fix: the risk to any given deployment is real only if developers have written code that directly mismanages XPathContext lifecycle, which the vendor describes as an unusual pattern absent from normal use. This is a real-world near-zero-priority issue for the vast majority of Nokogiri consumers.
Exploit ScenarioDerived	A Ruby application directly instantiates `Nokogiri::XML::XPathContext` from a parsed document, then allows the document variable to go out of scope and be collected by Ruby's GC while the XPathContext object remains live. When the application subsequently calls the XPathContext to evaluate an XPath expression, the underlying C code dereferences the freed document pointer, causing a segfault and crashing the Ruby process. No public exploit code exists; triggering this requires application-level API misuse, not crafted external input.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 25, 2026

Use-after-free in Nokogiri's CRuby implementation (versions prior to 1.19.4) allows an application crash via segfault when an XML::XPathContext object outlives its source document and that document is freed by Ruby's garbage collector. Only CRuby is affected; JRuby is not. This is not triggerable by malicious document input and cannot be reached through the standard Document#xpath, #css, or related methods - it requires an unusual direct API usage pattern in application code. No public exploit has been identified, this is not listed in CISA KEV, and the CVSS 4.0 score of 1.7 reflects the tightly constrained triggering conditions.

RemediationAI

Vendor-released patch: 1.19.4. Upgrade the nokogiri gem to version 1.19.4 or later, which causes XPathContext to hold a GC reference to its source document for the duration of the context's lifetime, eliminating the use-after-free with no breaking changes to the public API. See the advisory at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7 for release details. For deployments that cannot immediately upgrade, the effective workaround is to ensure any Ruby variable referencing the source document remains in scope and reachable for the full lifetime of any Nokogiri::XML::XPathContext constructed from it. Applications using only the standard Document#xpath, #css, #search, and related methods require no action, as those methods already maintain the document reference internally and are entirely unaffected.

Affected VersionsENISA

nokogiri < 1.19.4

Affected Packages

rubygems nokogiri fix: 1.19.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in rubygems

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Nokogiri is a widely used Ruby gem wrapping libxml2 and libxslt for XML and HTML parsing and XPath querying. CWE-416 (Use After Free) manifests in Nokogiri's C extension layer: Nokogiri::XML::XPathContext wraps libxml2's xmlXPathContextPtr and, prior to 1.19.4, held a raw C pointer to its source document without registering a GC reference. Ruby's mark-and-sweep garbage collector could therefore free the underlying document object while the XPathContext retained a dangling pointer. A subsequent XPath evaluation dereferences that freed memory, producing undefined behavior or a segfault. The fix in 1.19.4 roots the source document against GC for the full lifetime of the XPathContext. JRuby is unaffected because its XML implementation does not share this C-extension memory management model. Affected CPE: cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:*.

Know when Nokogiri gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 1.7 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

vuln.today AI 3.7 LOW

AC:H captures the non-default direct-XPathContext API misuse and GC timing required; only low availability impact applies via potential segfault.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

DescriptionCVE.org

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

High

dominant XML/HTML parser across Ruby and Rails production ecosystem

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +8

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.