Every CVE Search/ Get API key

CVE-2022-24839

Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)

7.5 HighFix available

org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.17%Up 1.3 points since Apr 12, 2022
90%50%10%1%

What each source reports

CVE List Score used 7.5

Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)

org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Record
CVE-2022-24839
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2023-1761 7.5

org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Record
EUVD-2023-1761
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9849-p7jc-9rmv 7.5

org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption

Summary

The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.

Severity

The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

Mitigation

Upgrade to >= 1.9.22.noko2.

Credit

This vulnerability was reported by 이형관 (windshock).

References

CWE-400 Uncontrolled Resource Consumption

Notes

The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Record
GHSA-9849-p7jc-9rmv
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.5

org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Record
CVE-2022-24839
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-400
Updated
2026-11-02
OSV 7.5

Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)

org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Record
CVE-2022-24839
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2022-24839 7.5

org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Record
DEBIAN-CVE-2022-24839
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
Show 9 moreShow less
OSVGHSA-9849-p7jc-9rmv 7.5

org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption

Summary

The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.

Severity

The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

Mitigation

Upgrade to >= 1.9.22.noko2.

Credit

This vulnerability was reported by 이형관 (windshock).

References

CWE-400 Uncontrolled Resource Consumption

Notes

The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Record
GHSA-9849-p7jc-9rmv
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVOESA-2022-1636 7.5

nekohtml security update

NekoHTML is a simple HTML scanner and tag balancer that enables application programmers to parse HTML documents and access the information using standard XML interfaces.

Security Fix(es): org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.(CVE-2022-24839)

Record
OESA-2022-1636
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-24839 7.5

org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Record
UBUNTU-CVE-2022-24839
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1770682159 No score

TuxCare security update for net.sourceforge.nekohtml:nekohtml (1 CVE)

TuxCare rebuilt net.sourceforge.nekohtml:nekohtml to address 1 CVE. Fixed in 1.9.22-tuxcare.1.

Record
CLSA-2026-1770682159
Updated
2026-11-02
OSVopenSUSE-SU-2024:11999-1 No score

ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11999-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13165-1 No score

ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13165-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14174-1 No score

ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14174-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14697-1 No score

ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14697-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10356-1 No score

ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10356-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.nokogiri:nekohtml
Maven
 before 1.9.22.noko2
1.9.22.noko2
net.sourceforge.nekohtml:nekohtml
TuxCare:Maven
 1.9.22 up to 1.9.22-tuxcare.1
1.9.22-tuxcare.1
nekohtml
Debian:12
 before 1.9.22.noko2-0.1
1.9.22.noko2-0.1
nekohtml
Debian:13
 before 1.9.22.noko2-0.1
1.9.22.noko2-0.1
nekohtml
Debian:14
 before 1.9.22.noko2-0.1
1.9.22.noko2-0.1
nekohtml
openEuler:20.03-LTS-SP1
 before 1.9.22-9.oe1
1.9.22-9.oe1
nekohtml
openEuler:20.03-LTS-SP3
 before 1.9.22-9.oe1
1.9.22-9.oe1
nekohtml
openEuler:22.03-LTS
 before 1.9.22-9.oe2203
1.9.22-9.oe2203
nekohtml
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.9.21-21.9.22-1
 None known
nekohtml
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.9.22-1
 None known
Show 11 moreShow less
Affected packages
PackageAffectedFixed
nekohtml
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.9.22-1
 None known
nekohtml
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.9.22-1.1
 None known
nekohtml
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.9.22.noko2-0.1
 None known
nekohtml
Ubuntu:25.10
 All versions, plus listed versions
1.9.22.noko2-0.1
 None known
nekohtml
Ubuntu:26.10
 All versions, plus listed versions
1.9.22.noko2-1
 None known
nekohtml
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.9.22.noko2-0.11.9.22.noko2-1
 None known
rubygem-nokogiri
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.13.4-1.1
1.13.4-1.1
ruby3.2-rubygem-nokogiri
openSUSE:Tumbleweed
From an advisory covering 41 CVEs
 before 1.13.9-1.7
1.13.9-1.7
rubygem-nokogiri
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 1.15.5-1.5
1.15.5-1.5
rubygem-nokogiri
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 1.18.2-1.1
1.18.2-1.1
rubygem-nokogiri
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 1.18.9-1.4
1.18.9-1.4

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24839 is a high vulnerability (CVSS 7.5) in Nekohtml Project Nekohtml, published April 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.17%, the 82nd percentile. Fixed in org.nokogiri:nekohtml 1.9.22.noko2.

References

Show 50 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open