GitHub Advisoryadvisory · Maven

GHSA-g9hh-vvx3-v37v Denial of service in HtmlUnit-Neko

HIGH Published 2022-04-23 Modified 2022-05-05 Official page ↗
Aliases
CVE-2022-28366
Ecosystem
Maven
Packages
net.sourceforge.htmlunit:neko-htmlunit
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reviewed
2022-04-26

Affected packages

• Maven net.sourceforge.htmlunit:neko-htmlunit: < 2.27 → fixed in 2.27

Description

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.

Related

Alias · CVE (1)

  • CVE-2022-28366 Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory… vulnerability

References