Improper resource allocation In nekohtml
Description
org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption
Summary
The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.
Severity
The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
Mitigation
Upgrade to >= 1.9.22.noko2.
Credit
This vulnerability was reported by 이형관 (windshock).
References
CWE-400 Uncontrolled Resource Consumption
Notes
The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 1.9.22.noko2-0.1 | ||
debian 11 | - | ||
debian 12 | 1.9.22.noko2-0.1 | ||
debian 14 | 1.9.22.noko2-0.1 | ||
 maven | 1.9.22.noko2 |
Aliases
References