{"id":"CVE-2022-29546","aliases":["EUVD-2022-1649","GHSA-6jmm-mp6w-4rrg"],"status":"published","title":"OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser","description":"HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01231,"percentile":0.69171,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-04-25T02:54:59Z","modified":"2026-11-04T02:30:50Z","fixes":[{"ecosystem":"Maven","package":"net.sourceforge.htmlunit:neko-htmlunit","fixed_in":["2.61.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.sourceforge.htmlunit:neko-htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.61.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"net.sourceforge.htmlunit:neko-htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.61.0"}]}],"versions":["2.21","2.23","2.24","2.25","2.27","2.28","2.30","2.31","2.32","2.33","2.34.0","2.35.0","2.36.0","2.37.0","2.38.0","2.39.0","2.40.0","2.41.0","2.42.0","2.43.0","2.44.0","2.45.0","2.46.0","2.47.0","2.47.1","2.48.0","2.49.0","2.50.0","2.51.0","2.52.0","2.53.0","2.54.0","2.55.0","2.56.0","2.57.0","2.58.0","2.59.0","2.60.0"]}],"products":[{"vendor":"htmlunit","product":"htmlunit"}],"references":[{"url":"https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-6jmm-mp6w-4rrg","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29546","tags":["advisory"]},{"url":"https://github.com/HtmlUnit/htmlunit-neko/commit/9d2aecd69223469e40c12ca3edddda09009110cc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6jmm-mp6w-4rrg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29546.json","tags":["advisory"]},{"url":"https://github.com/HtmlUnit/htmlunit-neko","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-29546","description":"HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.","status":"published","published":"2022-04-25T02:54:59Z","modified":"2026-11-02T22:04:14.906Z","updated_at":"2026-11-03T00:01:30.510858Z"}],"euvd":[{"id":"EUVD-2022-1649","description":"HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.","status":"published","published":"2022-04-25T02:54:59Z","modified":"2026-11-02T22:04:14Z","updated_at":"2026-11-03T05:08:36.239358Z"}],"ghsa":[{"id":"GHSA-6jmm-mp6w-4rrg","title":"OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser","description":"### Impact\nNekoHtml Parser suffers from a denial of service vulnerability on versions 2.60.0 and below. A specifically crafted input regarding the parsing of processing instructions leads to heap memory consumption. Please update to version 2.61.0.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [https://github.com/HtmlUnit/htmlunit-neko](https://github.com/HtmlUnit/htmlunit-neko)\n* Email us at [rbri at rbri.de]\n","status":"published","published":"2022-04-26T21:14:57Z","modified":"2023-01-27T05:02:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2022-29546","description":"HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.","status":"published","published":"2022-04-25T03:15:07.84Z","modified":"2026-11-02T22:17:13.707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-03T00:01:40.46005Z"}],"osv":[{"id":"GHSA-6jmm-mp6w-4rrg","title":"OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser","description":"### Impact\nNekoHtml Parser suffers from a denial of service vulnerability on versions 2.60.0 and below. A specifically crafted input regarding the parsing of processing instructions leads to heap memory consumption. Please update to version 2.61.0.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [https://github.com/HtmlUnit/htmlunit-neko](https://github.com/HtmlUnit/htmlunit-neko)\n* Email us at [rbri at rbri.de]\n","status":"published","published":"2022-04-26T21:14:57Z","modified":"2026-07-08T06:29:09.619349827Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"CVE-2022-29546","description":"HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.","status":"published","published":"2022-04-25T02:54:59Z","modified":"2026-11-04T02:30:50.602153545Z","updated_at":"2026-11-04T02:54:44.889498Z"}]}}