In short
- CVE-2022-24836 is a HIGH (CVSS 7.5) vulnerability affecting nokogiri, nokogiri (nokogiri).
- Chance of exploitation in the next 30 days (EPSS): 3.5%, higher than 89.2% of all vulnerabilities.
- Fix: update to 1.13.4 or later.
| Package | Affected versions | Patched versions |
|---|
| nokogiri RubyGems | < 1.13.4
| 1.13.4
|
| nokogiri | < 1.13.4
| 1.13.4
|
Description
Summary
Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.
Mitigation
Upgrade to Nokogiri >= 1.13.4.
Severity
The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
References
CWE-1333 Inefficient Regular Expression Complexity
Credit
This vulnerability was reported by HackerOne user ooooooo_q (ななおく).
NVD description
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free