Nokogiri EUVD-2026-65529

Exploitation requires the target application to explicitly pass attacker-controllable data as parameters to Nokogiri::XSLT::Stylesheet#transform, and the attacker-supplied input must contain at least one null byte to trigger the leaking code path. Applications that do not use Nokogiri's XSLT transform feature, that use it only with static or internally-controlled parameters, or that sanitize transform inputs to strip null bytes are not affected - regardless of Nokogiri version. Meaningful denial of service further requires sustained high-call-rate traffic to accumulate sufficient leaked memory, since each individual leak is only 24-32 bytes; low-frequency or isolated requests present negligible practical risk. The CVSS AV:N/PR:N metrics apply only in the scenario where the application exposes an XSLT-parameterized endpoint to unauthenticated network clients; applications behind authentication or that restrict XSLT parameter sources to trusted callers face correspondingly reduced exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) characterizes a network-reachable, low-complexity attack requiring no privileges or user interaction, producing low availability impact on the vulnerable system with no confidentiality or integrity consequence. However, this must be read carefully against the real-world impact signals: the Nokogiri maintainers independently assessed CVSS 5.3 Moderate, citing the 24-32 byte per-leak allocation that requires sustained high-call-rate attacker traffic to produce meaningful memory growth. EPSS data was not provided, and the vulnerability is not in CISA KEV, so exploitation probability cannot be quantitatively assessed. No public exploit code has been identified. The critical limiting factor is application architecture: only applications that explicitly pass raw, unvalidated user-supplied data to XSLT transform parameters are exposed - this is an uncommon code pattern, not default behavior, which substantially narrows the realistic attack surface beyond what the CVSS network vector alone implies. Risk is effectively zero for applications that do not use parameterized XSLT transforms with untrusted input.

An attacker discovers or infers that a web application exposes an endpoint which accepts user-supplied data and passes it as a parameter to a Nokogiri XSLT transform - for example, an XML document transformation API. The attacker submits a high volume of requests with null bytes embedded in the relevant parameter field. Each request silently leaks 24-32 bytes of heap memory in the application process; under sustained traffic the process memory grows continuously until the operating system or a process manager terminates it due to resource exhaustion, causing a denial of service. No public exploit code has been identified, and the attack requires knowledge of or access to the specific XSLT-parameterized endpoint.