Log in Start free

Vulnerability · Published Apr 11, 2022 · Assigned by GitHub_M

CVE-2022-24836Inefficient Regular Expression Complexity in Nokogiri

High 7.5

In plain English

A high-severity uncontrolled resource consumption in nokogiri from sparklemotion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.5%top 10.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20ruby-nokogiri1.13.4-r0ALPINE-CVE-2022-24836
Alpine:v3.21ruby-nokogiri1.13.4-r0ALPINE-CVE-2022-24836
Alpine:v3.22ruby-nokogiri1.13.4-r0ALPINE-CVE-2022-24836
Alpine:v3.23ruby-nokogiri1.13.4-r0ALPINE-CVE-2022-24836
Alpine:v3.24ruby-nokogiri1.13.4-r0ALPINE-CVE-2022-24836
Debian:12ruby-nokogiri1.13.5+dfsg-1DEBIAN-CVE-2022-24836
Debian:13ruby-nokogiri1.13.5+dfsg-1DEBIAN-CVE-2022-24836
Debian:14ruby-nokogiri1.13.5+dfsg-1DEBIAN-CVE-2022-24836
Rocky Linux:8libdb0:5.3.28-42.el8_4RLSA-2022:8506
RubyGemsnokogiri1.13.4GHSA-crjr-9rc5-ghw8

Affected products (as reported)

VendorProductVersions
sparklemotion nokogiri < 1.13.4

Weakness: CWE-400, CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References