org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption

高 7.5CVE-2022-24839 · GHSA-9849-p7jc-9rmv · 11/04/2022 公開 · 17/06/2026 更新

要点

CVE-2022-24839 は org.nokogiri:nekohtml, nekohtml (nekohtml project), weblogic server (oracle) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.2%（全脆弱性の 82.2% より高い）。
対処：1.9.22.noko2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.nokogiri:nekohtml Maven	`< 1.9.22.noko2`	`1.9.22.noko2`
nekohtml nekohtml_project	`< 1.9.22.noko2`	`1.9.22.noko2`
weblogic server oracle	`= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0`	修正版なし

概要

Summary

The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.

Severity

The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

Mitigation

Upgrade to >= 1.9.22.noko2.

Credit

This vulnerability was reported by 이형관 (windshock).

References

CWE-400 Uncontrolled Resource Consumption

Notes

The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

NVD の説明

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.