GitHub Advisoryadvisory · Maven

GHSA-9849-p7jc-9rmv org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption

HIGH Published 2023-06-22 Modified 2023-06-22 Official page ↗
Aliases
CVE-2022-24839
Ecosystem
Maven
Packages
org.nokogiri:nekohtml
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-06-22

Affected packages

• Maven org.nokogiri:nekohtml: < 1.9.22.noko2 → fixed in 1.9.22.noko2

Description

Summary The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Severity The maintainers have evaluated this as High Severity 7.5 (CVSS3.1). Mitigation Upgrade to `>= 1.9.22.noko2`. Credit This vulnerability was reported by 이형관 (windshock). References CWE-400 Uncontrolled Resource Consumption Notes The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Related

Alias · CVE (1)

  • CVE-2022-24839 org.cyberneko.html is an html parser written in Java. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References