CVE-2022-24839highCWE-400

CVE-2022-24839: high-severity vulnerability in sparklemotion nekohtml

Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)

Published · Updated

Follow this CVE+ Monitor nekohtml+ Monitor nekohtml

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 2.2%
In short

A vulnerability in the HTML parser used by Nokogiri allows attackers to crash applications by sending specially crafted malformed HTML that consumes excessive memory. This can be exploited to cause a denial of service.

Technical detail

The org.cyberneko.html parser (Nokogiri's fork) fails to properly limit resource consumption when processing malformed HTML, triggering an OutOfMemoryError. An attacker can send crafted HTML input to exhaust heap memory and crash the application; this is a classic uncontrolled resource consumption vulnerability affecting any application parsing untrusted HTML via vulnerable Nokogiri versions.

Summary generated and translated by AI from the official description.
org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
sparklemotion · nekohtml