CVE-2022-24839: Uncontrolled Resource Consumption

June 22, 2023

org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

References

github.com/advisories/GHSA-9849-p7jc-9rmv
github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d
github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv
nvd.nist.gov/vuln/detail/CVE-2022-24839
www.oracle.com/security-alerts/cpujul2022.html

Code Behaviors & Features

Detect and mitigate CVE-2022-24839 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →