GitHub Advisoryadvisory · RubyGems

GHSA-crjr-9rc5-ghw8 Nokogiri Inefficient Regular Expression Complexity

HIGH Published 2022-04-11 Modified 2023-07-06 Official page ↗
Aliases
CVE-2022-24836
Ecosystem
RubyGems
Packages
nokogiri
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400
Reviewed
2022-04-11

Affected packages

• RubyGems nokogiri: < 1.13.4 → fixed in 1.13.4

Description

Summary Nokogiri `= 1.13.4`. Severity The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1). References CWE-1333 Inefficient Regular Expression Complexity Credit This vulnerability was reported by HackerOne user ooooooo_q (ななおく).

Related

Alias · CVE (1)

  • CVE-2022-24836 Nokogiri is an open source XML and HTML library for Ruby. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References