https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:39:06.376802+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-01887 bdu:2024-01887 2026-10-02T18:39:06.758584+00:00 bdu:2024-01887 https://cve.radiocsirt.org/vuln/certfr-2022-avi-659 certfr-2022-avi-659 — De multiples vulnérabilités ont été découvertes dans Oracle WebLogic. Certaines d'entre elles permettent à un attaquant… 2026-10-02T18:39:06.758629+00:00 certfr-2022-avi-659 https://cve.radiocsirt.org/vuln/euvd-2026-234263 EUVD-2026-234263 2026-10-02T18:39:06.758649+00:00 EUVD-2026-234263 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24839 fkie_cve-2022-24839 2026-10-02T18:39:06.758677+00:00

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-9849-p7jc-9rmv GHSA-9849-p7jc-9rmv — org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption 2026-10-02T18:39:06.758711+00:00

Affected: Maven: org.nokogiri:nekohtml

## Summary

The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.

## Severity

The maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

## Mitigation

Upgrade to `>= 1.9.22.noko2`.

## Credit

This vulnerability was reported by [이형관 (windshock)](https://www.linkedin.com/in/windshock/).

## References

[CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption

## Notes

The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2022-24839 gsd-2022-24839 2026-10-02T18:39:06.758752+00:00 gsd-2022-24839 https://cve.radiocsirt.org/vuln/oesa-2022-1636 OESA-2022-1636 — nekohtml security update 2026-10-02T18:39:06.758765+00:00

Affected: openEuler:20.03-LTS-SP1: nekohtml, openEuler:20.03-LTS-SP3: nekohtml, openEuler:22.03-LTS: nekohtml

NekoHTML is a simple HTML scanner and tag balancer that enables application programmers to parse HTML documents and access the information using standard XML interfaces. Security Fix(es): org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.(CVE-2022-24839)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11999-1 openSUSE-SU-2024:11999-1 — ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media 2026-10-02T18:39:06.758793+00:00

ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24839 UBUNTU-CVE-2022-24839 2026-10-02T18:39:06.758812+00:00

Affected: Ubuntu:16.04:LTS: nekohtml, Ubuntu:18.04:LTS: nekohtml, Ubuntu:20.04:LTS: nekohtml, Ubuntu:22.04:LTS: nekohtml, Ubuntu:24.04:LTS: nekohtml, Ubuntu:25.10: nekohtml, Ubuntu:26.04:LTS: nekohtml

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0122 WID-SEC-W-2023-0122 — Oracle Supply Chain: Mehrere Schwachstellen 2026-10-02T18:39:06.758842+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.