Log in Start free

Vulnerability · Published Apr 21, 2022 · Assigned by mitre

CVE-2022-28366

High 7.5

In plain English

A high-severity security flaw in the libowasp-antisamy-java package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.2%top 17.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libowasp-antisamy-javano fix listedDEBIAN-CVE-2022-28366
Debian:13libowasp-antisamy-java1.7.4-1DEBIAN-CVE-2022-28366
Debian:14libowasp-antisamy-java1.7.4-1DEBIAN-CVE-2022-28366
Mavennet.sourceforge.htmlunit:neko-htmlunit2.27GHSA-g9hh-vvx3-v37v
Ubuntu:22.04:LTSlibowasp-antisamy-javano fix listedUBUNTU-CVE-2022-28366
Ubuntu:24.04:LTSlibowasp-antisamy-javano fix listedUBUNTU-CVE-2022-28366
Ubuntu:25.10libowasp-antisamy-javano fix listedUBUNTU-CVE-2022-28366
Ubuntu:26.04:LTSlibowasp-antisamy-javano fix listedUBUNTU-CVE-2022-28366
Ubuntu:26.10libowasp-antisamy-javano fix listedUBUNTU-CVE-2022-28366

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References