Most recent entries from all

bdu:2024-01887

certfr-2022-avi-659 — De multiples vulnérabilités ont été découvertes dans Oracle WebLogic. Certaines d'entre elles permettent à un attaquant…

certfr-2022-avi-659

EUVD-2026-234263

fkie_cve-2022-24839

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

GHSA-9849-p7jc-9rmv — org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption

Affected: Maven: org.nokogiri:nekohtml

## Summary

The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.

## Severity

The maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

## Mitigation

Upgrade to `>= 1.9.22.noko2`.

## Credit

This vulnerability was reported by [이형관 (windshock)](https://www.linkedin.com/in/windshock/).

## References

[CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption

## Notes

The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

gsd-2022-24839

OESA-2022-1636 — nekohtml security update

Affected: openEuler:20.03-LTS-SP1: nekohtml, openEuler:20.03-LTS-SP3: nekohtml, openEuler:22.03-LTS: nekohtml

NekoHTML is a simple HTML scanner and tag balancer that enables application programmers to parse HTML documents and access the information using standard XML interfaces. Security Fix(es): org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.(CVE-2022-24839)

openSUSE-SU-2024:11999-1 — ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media

ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media

UBUNTU-CVE-2022-24839

Affected: Ubuntu:16.04:LTS: nekohtml, Ubuntu:18.04:LTS: nekohtml, Ubuntu:20.04:LTS: nekohtml, Ubuntu:22.04:LTS: nekohtml, Ubuntu:24.04:LTS: nekohtml, Ubuntu:25.10: nekohtml, Ubuntu:26.04:LTS: nekohtml

WID-SEC-W-2023-0122 — Oracle Supply Chain: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.