Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 2.1%
exploitation probability
2.1%top 20% of all CVEs
observed exploitation
nono source reports it
In short
A vulnerability in the HTML parser used by Nokogiri allows attackers to crash applications by sending specially crafted malformed HTML that consumes excessive memory. This can be exploited to cause a denial of service.
Technical detail
The org.cyberneko.html parser (Nokogiri's fork) fails to properly limit resource consumption when processing malformed HTML, triggering an OutOfMemoryError. An attacker can send crafted HTML input to exhaust heap memory and crash the application; this is a classic uncontrolled resource consumption vulnerability affecting any application parsing untrusted HTML via vulnerable Nokogiri versions.
Summary generated and translated by AI from the official description.
org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
sparklemotion · nekohtml