sparklemotion/nekohtml · Security
org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption
- GHSA ID
- GHSA-9849-p7jc-9rmv
- CVE ID
- CVE-2022-24839
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Summary
The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.
Severity
The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
Mitigation
Upgrade to >= 1.9.22.noko2.
Credit
This vulnerability was reported by 이형관 (windshock).
References
CWE-400 Uncontrolled Resource Consumption
Notes
The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
CWEs
- CWE-400 · Uncontrolled Resource Consumption
References
- https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv ↗
- https://nvd.nist.gov/vuln/detail/CVE-2022-24839 ↗
- https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d ↗
- https://www.oracle.com/security-alerts/cpujul2022.html ↗
- https://github.com/advisories/GHSA-9849-p7jc-9rmv ↗