| Package | Affected versions | Patched versions |
|---|---|---|
| org.nokogiri:nekohtml | < 1.9.22.noko2 | 1.9.22.noko2 |
| nekohtml | < 1.9.22.noko2 | 1.9.22.noko2 |
| weblogic server | = 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0 |
The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.
The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
Upgrade to >= 1.9.22.noko2.
This vulnerability was reported by 이형관 (windshock).
CWE-400 Uncontrolled Resource Consumption
The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free