Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
Summary
Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
Original description
The description as published by the source.
org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-24839 nekohtml
- Ubuntu UBUNTU-CVE-2022-24839 nekohtml
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web oracle.com