org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption

CAO 7.5CVE-2022-24839 · GHSA-9849-p7jc-9rmv · Công bố 11/04/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-24839 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng org.nokogiri:nekohtml, nekohtml (nekohtml project), weblogic server (oracle).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.2%, cao hơn 82.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.9.22.noko2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.nokogiri:nekohtml Maven	`< 1.9.22.noko2`	`1.9.22.noko2`
nekohtml nekohtml_project	`< 1.9.22.noko2`	`1.9.22.noko2`
weblogic server oracle	`= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0`	Chưa có bản vá

Mô tả

Summary

The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.

Severity

The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

Mitigation

Upgrade to >= 1.9.22.noko2.

Credit

This vulnerability was reported by 이형관 (windshock).

References

CWE-400 Uncontrolled Resource Consumption

Notes

The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Mô tả của NVD

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.