Skip to content

Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)

High
flavorjones published GHSA-9849-p7jc-9rmv Apr 11, 2022

Package

maven org.cyberneko.html (nokogiri fork) (Maven)

Affected versions

< 1.9.22.noko2

Patched versions

1.9.22.noko2

Description

Summary

The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.

Severity

The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

Mitigation

Upgrade to >= 1.9.22.noko2.

Credit

This vulnerability was reported by 이형관 (windshock).

References

CWE-400 Uncontrolled Resource Consumption

Notes

The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Severity

High
7.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE ID

CVE-2022-24839

Weaknesses