A memory corruption vulnerability in Nokogiri versions before 1.13.5 poses a significant risk of service disruption or potential code execution.

This is a memory buffer issue (CWE-119) caused by an integer overflow in libxml2. The attack vector is network based and requires no authentication or user interaction to trigger.

The vulnerability carries a CVSS score of 8.6, reflecting its potential for high availability impact. Successful exploitation could lead to application crashes, causing significant service downtime, or potentially allow an attacker to execute arbitrary code within the context of the affected process.

Immediate Action: Update the Nokogiri library to version 1.13.5 or later to incorporate the necessary libxml2 fixes.

Proactive Monitoring: Monitor application error logs for unexpected segmentation faults or memory-related crashes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic for malformed XML payloads that attempt to trigger memory management errors.

Public Exploit Available: Unknown

Given the severity of this memory safety issue and its potential for service disruption, organizations should prioritize updating the Nokogiri dependency in all development and production environments. Implementing the patch is the only definitive way to resolve the underlying buffer management flaw.