{"id":"CVE-2022-24836","aliases":["ALPINE-CVE-2022-24836","BELL-CVE-2022-24836","DEBIAN-CVE-2022-24836","DLA-3003-1","DLA-3149-1","DLA-3868-1","EUVD-2022-1712","GHSA-crjr-9rc5-ghw8","MGASA-2022-0164","OESA-2022-1644","RHSA-2022:8506","RLSA-2022:8506","SUSE-SU-2022:3890-1","SUSE-SU-2022:4015-1","SUSE-SU-2022:4016-1","UBUNTU-CVE-2022-24836","openSUSE-SU-2024:11999-1","openSUSE-SU-2024:13165-1","openSUSE-SU-2024:14174-1","openSUSE-SU-2025:14697-1","openSUSE-SU-2026:10356-1"],"status":"published","title":"Inefficient Regular Expression Complexity in Nokogiri","description":"Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.03519,"percentile":0.89387,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2022-04-11T00:00:00Z","modified":"2026-11-03T08:02:44Z","fixes":[{"ecosystem":"RubyGems","package":"nokogiri","fixed_in":["1.13.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ruby-nokogiri","fixed_in":["1.13.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ruby-nokogiri","fixed_in":["1.13.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-nokogiri","fixed_in":["1.13.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-nokogiri","fixed_in":["1.13.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"ruby-nokogiri","fixed_in":["1.6.8.1-1+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"ruby-nokogiri","fixed_in":["1.11.1+dfsg-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"ruby-nokogiri","fixed_in":["1.11.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-nokogiri","fixed_in":["1.10.5-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-nokogiri","fixed_in":["1.10.5-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"rubygem-nokogiri","fixed_in":["1.13.1-2.oe2203"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8.1-1+deb9u2"}]}],"versions":["1.6.8.1-1","1.6.8.1-1+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0+dfsg1-2+deb10u1"}]}],"versions":["1.10.0+dfsg1-2"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1+dfsg-2+deb11u1"}]}],"versions":["1.11.1+dfsg-2"]},{"source":"osv","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.10.0","1.10.0.rc1","1.10.1","1.10.10","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.0.rc1","1.11.0.rc2","1.11.0.rc3","1.11.0.rc4","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.0.rc1","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0.rc1","1.9.1"]},{"source":"osv","ecosystem":"Mageia:8","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.5-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.5-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-2.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.15-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"candlepin-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.15-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-2.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.28-42.el8_4"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-5.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-5.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-150000.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-150000.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-150000.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-150000.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-150000.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-150400.14.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-150400.14.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.9-2","1.5.9-3","1.6.0-1","1.6.1+ds-1","1.6.1+ds-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.6.2+ds-2build2","1.6.6.3-1","1.6.7-1","1.6.7.1-1","1.6.7.2-3","1.6.7.2-3build1","1.6.7.2-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.1-1","1.8.1-1build1","1.8.2-1build1","1.8.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.3+dfsg1-2","1.10.4+dfsg1-1","1.10.7+dfsg1-1","1.10.7+dfsg1-2","1.10.7+dfsg1-2build1","1.10.7+dfsg1-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.1+dfsg-2ubuntu1","1.11.7+dfsg-3","1.11.7+dfsg-3build1","1.13.1+dfsg-2","1.13.1+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.9-1.7"}]}],"bundled":41},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5-1.5"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-1.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.9-1.4"}]}],"bundled":44}],"products":[{"vendor":"apple","product":"macos"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nokogiri","product":"nokogiri"},{"vendor":"sparklemotion","product":"nokogiri"}],"references":[{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8","tags":["x_transferred","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://security.gentoo.org/glsa/202208-29","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://support.apple.com/kb/HT213532","tags":["x_transferred","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/23","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00010.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24836","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4","tags":["web"]},{"url":"https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email\u0026utm_source=footer","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-24836.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-crjr-9rc5-ghw8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-24836","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-24836","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24836.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24836","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0164.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30322","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8506","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1309740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1894033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1908841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1952939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1973329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2016924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022065","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060651","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070732","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2074346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076843","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2093884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2098240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2099620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103129","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115832","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118055","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118790","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124047","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2133468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139371","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8506.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37136","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22818","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/feb/01/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24836","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24836","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25648","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-GIT-2421270","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29181","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29970","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29970","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32209","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32209","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34265","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6861","tags":["advisory"]},{"url":"https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2","tags":["article"]},{"url":"https://projects.theforeman.org/issues/34328","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8506","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223890-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198408","tags":["report"]},{"url":"https://bugzilla.suse.com/1199782","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29181","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224015-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224016-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24836","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29469","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U5YNW74OL2W7SH2XTAVN5TODNFIVFL3Y/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-24836","title":"Inefficient Regular Expression Complexity in Nokogiri","description":"Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.","status":"published","published":"2022-04-11T00:00:00Z","modified":"2024-09-03T12:03:46.858Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-1712","description":"Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.","status":"published","published":"2022-04-11T00:00:00Z","modified":"2024-09-03T12:03:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:06.59198Z"}],"ghsa":[{"id":"GHSA-crjr-9rc5-ghw8","title":"Nokogiri Inefficient Regular Expression Complexity","description":"## Summary\n\nNokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.\n\n## Mitigation\n\nUpgrade to Nokogiri `\u003e= 1.13.4`.\n\n\n## Severity\n\nThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\n\n## References\n\n[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity\n\n\n## Credit\n\nThis vulnerability was reported by HackerOne user ooooooo_q (ななおく).\n","status":"published","published":"2022-04-11T21:18:06Z","modified":"2023-07-06T16:02:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2022-24836","description":"Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.","status":"published","published":"2022-04-11T22:15:07.347Z","modified":"2026-06-17T04:32:37.603Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:07:15.414503Z"}],"osv":[{"id":"ALPINE-CVE-2022-24836","description":"Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.","status":"published","published":"2022-04-11T22:15:07.347Z","modified":"2026-11-03T07:30:15.297245775Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"BELL-CVE-2022-24836","title":"CVE-2022-24836 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:52.388514Z","modified":"2026-01-26T09:49:41.732595Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-24836","title":"Inefficient Regular Expression Complexity in Nokogiri","description":"Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.","status":"published","published":"2022-04-11T00:00:00Z","modified":"2026-10-28T02:30:25.294573332Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24836","description":"Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.","status":"published","published":"2022-04-11T22:15:07.347Z","modified":"2026-11-03T08:02:44.470769229Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-crjr-9rc5-ghw8","title":"Nokogiri Inefficient Regular Expression Complexity","description":"## Summary\n\nNokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.\n\n## Mitigation\n\nUpgrade to Nokogiri `\u003e= 1.13.4`.\n\n\n## Severity\n\nThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\n\n## References\n\n[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity\n\n\n## Credit\n\nThis vulnerability was reported by HackerOne user ooooooo_q (ななおく).\n","status":"published","published":"2022-04-11T21:18:06Z","modified":"2024-02-16T08:26:57.925644Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"OESA-2022-1644","title":"rubygem-nokogiri security update","description":"Nokogiri parses and searches XML/HTML very quickly, and also has correctly implemented CSS3 selector support as well as XPath support. Nokogiri also features an Hpricot compatibility layer to help ease the change to using correct CSS and XPath.\n\nSecurity Fix(es):\n\nNokogiri is an open source XML and HTML library for Ruby. Nokogiri less than v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri \u003e= 1.13.4. There are no known workarounds for this issue.(CVE-2022-24836)","status":"published","published":"2022-05-11T11:04:55Z","modified":"2026-08-18T01:16:32.154647749Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:8506","title":"Red Hat Security Advisory: Satellite 6.12 Release","status":"published","published":"2024-09-29T19:10:39Z","modified":"2026-10-13T10:03:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2022-24836","description":"Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.","status":"published","published":"2022-04-11T22:15:00Z","modified":"2025-10-24T04:53:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-3003-1","title":"ruby-nokogiri - security update","status":"published","published":"2022-05-13T00:00:00Z","modified":"2026-03-09T01:18:18.800921Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3149-1","title":"ruby-nokogiri - security update","status":"published","published":"2022-10-12T00:00:00Z","modified":"2026-03-09T01:20:00.59998Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3868-1","title":"ruby-nokogiri - security update","status":"published","published":"2024-09-03T00:00:00Z","modified":"2026-03-09T01:22:47.446528Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0164","title":"Updated ruby-nokogiri packages fix security vulnerability","description":"Fix for possible DOS by regex. (CVE-2022-24836)\n","status":"published","published":"2022-05-08T07:58:48Z","modified":"2026-04-16T04:43:50.187318019Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11999-1","title":"ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:19:15.890163Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:13165-1","title":"ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:20:35.126789Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14174-1","title":"ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T03:03:19.688417Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:14697-1","title":"ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-25T00:00:00Z","modified":"2026-02-04T03:50:12.082525Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2026:10356-1","title":"ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.568806Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"RLSA-2022:8506","title":"Important: Satellite 6.12 Release","description":"Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based\ninfrastructure. It allows for provisioning, remote management, and\nmonitoring of multiple Linux deployments with a single centralized tool.\n\nSecurity Fix(es):\n* netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)\n* netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n* python3-django: Possible XSS via template tag (CVE-2022-22818)\n* tfm-rubygem-nokogiri: ReDoS in HTML encoding detection (CVE-2022-24836)\n* tfm-rubygem-sinatra: Path traversal possible outside of public_dir when serving static files (CVE-2022-29970)\n* tfm-rubygem-git: Package vulnerable to Command Injection via git argument injection (CVE-2022-25648)\n* rubygem-rails-html-sanitizer: Possible XSS with certain configurations (CVE-2022-32209)\n* python3-django: Potential SQL injection via Trunc and Extract arguments (CVE-2022-34265)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAdditional Changes:\n\nThe items above are not a complete list of changes. This update also fixes\nseveral bugs and adds various enhancements. Documentation for these changes\nis available from the Release Notes document.","status":"published","published":"2022-11-16T13:21:30Z","modified":"2026-02-04T16:00:10.880515Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"SUSE-SU-2022:3890-1","title":"Security update for rubygem-nokogiri","description":"This update for rubygem-nokogiri fixes the following issues:\n\n- CVE-2022-24836: Fixes possibility to DoS because of inefficient RE in HTML encoding. (bsc#1198408)\n- CVE-2022-29181: Fixes Improper Handling of Unexpected Data Typesi. (bsc#1199782)\n","status":"published","published":"2022-11-07T14:29:36Z","modified":"2026-02-04T02:32:22.582243Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4015-1","title":"Security update for rubygem-nokogiri","description":"This update for rubygem-nokogiri fixes the following issues:\n\n- CVE-2022-24836: Fixes possibility to DoS because of inefficient RE in HTML encoding. (bsc#1198408)\n- CVE-2022-29181: Fixes Improper Handling of Unexpected Data Typesi. (bsc#1199782)\n","status":"published","published":"2022-11-16T13:51:54Z","modified":"2026-02-04T03:17:14.00474Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4016-1","title":"Security update for rubygem-nokogiri","description":"This update for rubygem-nokogiri fixes the following issues:\n\n- CVE-2022-24836: Fixes possibility to DoS because of inefficient RE in HTML encoding. (bsc#1198408)\n- CVE-2022-29181: Fixes Improper Handling of Unexpected Data Typesi. (bsc#1199782)\n","status":"published","published":"2022-11-16T13:52:15Z","modified":"2026-02-04T02:52:00.21526Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}