{"id":"CVE-2023-34624","aliases":["DEBIAN-CVE-2023-34624","DLA-3520-1","DSA-5471-1","EUVD-2023-1838","GHSA-jv4x-j47q-6qvp","UBUNTU-CVE-2023-34624","USN-6683-1"],"status":"published","title":"htmlcleaner vulnerable to stack exhaustion","description":"An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01048,"percentile":0.64502,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-787"],"published":"2023-06-14T00:00:00Z","modified":"2026-10-26T18:00:11Z","fixes":[{"ecosystem":"Maven","package":"net.sourceforge.htmlcleaner:htmlcleaner","fixed_in":["2.29"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libhtmlcleaner-java","fixed_in":["2.26-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libhtmlcleaner-java","fixed_in":["2.29-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libhtmlcleaner-java","fixed_in":["2.29-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libhtmlcleaner-java","fixed_in":["2.21-5+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libhtmlcleaner-java","fixed_in":["2.24-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libhtmlcleaner-java","fixed_in":["2.21-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libhtmlcleaner-java","fixed_in":["2.23-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libhtmlcleaner-java","fixed_in":["2.24-1+deb11u1build0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.sourceforge.htmlcleaner:htmlcleaner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-1+deb12u1"}]}],"versions":["2.26-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-5+deb10u1"}]}],"versions":["2.21-5"]},{"source":"osv","ecosystem":"Debian:11","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-1+deb11u1"}]}],"versions":["2.24-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-1+deb12u1"}]}],"versions":["2.26-1"]},{"source":"osv","ecosystem":"Maven","package":"net.sourceforge.htmlcleaner:htmlcleaner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29"}]}],"versions":["2.10","2.11","2.12","2.13","2.14","2.15","2.16","2.17","2.18","2.19","2.2","2.2.1","2.20","2.21","2.22","2.23","2.24","2.25","2.26","2.27","2.28","2.4","2.5","2.6","2.6.1","2.7","2.8","2.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-2ubuntu0.1~esm1"}]}],"versions":["2.2-1","2.21-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-1ubuntu0.1~esm1"}]}],"versions":["2.22-2","2.23-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-1+deb11u1build0.22.04.1"}]}],"versions":["2.24-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-2ubuntu0.1~esm1"}]}],"versions":["2.2-1","2.21-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-1ubuntu0.1~esm1"}]}],"versions":["2.22-2","2.23-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhtmlcleaner-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-1+deb11u1build0.22.04.1"}]}],"versions":["2.24-1"]}],"products":[{"vendor":"htmlcleaner_project","product":"htmlcleaner"}],"references":[{"url":"https://github.com/amplafi/htmlcleaner/issues/13","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00007.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://www.debian.org/security/2023/dsa-5471","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34624","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jv4x-j47q-6qvp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-34624","tags":["advisory"]},{"url":"https://github.com/amplafi/htmlcleaner","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-34624","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6683-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-34624","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-34624","description":"An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","status":"published","published":"2023-06-14T00:00:00Z","modified":"2025-01-06T19:31:08.126Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:35.912488Z"}],"euvd":[{"id":"EUVD-2023-1838","description":"An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","status":"published","published":"2023-06-14T00:00:00Z","modified":"2025-01-06T19:31:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:25.174818Z"}],"ghsa":[{"id":"GHSA-jv4x-j47q-6qvp","title":"htmlcleaner vulnerable to stack exhaustion","description":"An issue was discovered htmlcleaner through version 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","status":"published","published":"2023-06-14T15:30:38Z","modified":"2025-01-06T22:14:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-787"],"updated_at":"2026-11-02T14:38:26.167657Z"}],"nvd":[{"id":"CVE-2023-34624","description":"An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","status":"published","published":"2023-06-14T14:15:10.36Z","modified":"2026-06-17T06:03:53.09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:06.335469Z"}],"osv":[{"id":"CVE-2023-34624","description":"An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","status":"published","published":"2023-06-14T14:15:10.36Z","modified":"2026-03-14T12:07:26.170642Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"DEBIAN-CVE-2023-34624","description":"An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","status":"published","published":"2023-06-14T14:15:10.36Z","modified":"2026-10-26T18:00:11.44533773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-jv4x-j47q-6qvp","title":"htmlcleaner vulnerable to stack exhaustion","description":"An issue was discovered htmlcleaner through version 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","status":"published","published":"2023-06-14T15:30:38Z","modified":"2025-01-06T22:24:31.763207Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-787"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"UBUNTU-CVE-2023-34624","description":"An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","status":"published","published":"2023-06-14T14:15:00Z","modified":"2026-02-04T03:53:46.672383Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"DLA-3520-1","title":"libhtmlcleaner-java - security update","status":"published","published":"2023-08-07T00:00:00Z","modified":"2026-03-09T01:23:33.435817Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5471-1","title":"libhtmlcleaner-java - security update","status":"published","published":"2023-08-07T00:00:00Z","modified":"2026-03-09T02:10:59.521947Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-6683-1","title":"libhtmlcleaner-java vulnerability","description":"\nIt was discovered that HtmlCleaner incorrectly handled certain html\ndocuments. An attacker could possibly use this issue to cause a denial\nof service via application crash.\n\n","status":"published","published":"2024-03-07T14:46:12Z","modified":"2026-02-10T04:43:32Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}