Vulnerability · Published Apr 11, 2022 · Assigned by GitHub_M
CVE-2022-24839Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
High 7.5
In plain English
A high-severity uncontrolled resource consumption in nekohtml from sparklemotion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nekohtml | 1.9.22.noko2-0.1 | DEBIAN-CVE-2022-24839 |
| Debian:13 | nekohtml | 1.9.22.noko2-0.1 | DEBIAN-CVE-2022-24839 |
| Debian:14 | nekohtml | 1.9.22.noko2-0.1 | DEBIAN-CVE-2022-24839 |
| Maven | org.nokogiri:nekohtml | 1.9.22.noko2 | GHSA-9849-p7jc-9rmv |
| Ubuntu:22.04:LTS | nekohtml | no fix listed | UBUNTU-CVE-2022-24839 |
| Ubuntu:24.04:LTS | nekohtml | no fix listed | UBUNTU-CVE-2022-24839 |
| Ubuntu:25.10 | nekohtml | no fix listed | UBUNTU-CVE-2022-24839 |
| Ubuntu:26.04:LTS | nekohtml | no fix listed | UBUNTU-CVE-2022-24839 |
| Ubuntu:26.10 | nekohtml | no fix listed | UBUNTU-CVE-2022-24839 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sparklemotion | nekohtml | < 1.9.22.noko2 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H