Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.nokogiri:nekohtml

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption

    CVE-2022-24839 · GHSA-9849-p7jc-9rmv

    Affected
    • Maven org.nokogiri:nekohtml < 1.9.22.noko2
    Fixed in
    1.9.22.noko2· Vendor fix available
    Issue
    The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Severity The maintainers have evaluated this as High Severity 7.5 (CVSS3.1). Mitigation Upgrade to = 1.9.22.noko2. Credit This vulnerability was reported by 이형관 (windshock). References CWE-400 Uncontrolled Resource Consumption Notes The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

    Recommended action: Upgrade to 1.9.22.noko2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →