CVE-2022-24836

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-1333

Affected software

VendorProductVersions
sparklemotionnokogiri< 1.13.4

References

Timeline

Published
Apr 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-248375.3HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later havCVE-2022-248389.8Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlCVE-2022-248397.5org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMCVE-2022-24847.8The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmwaCVE-2022-248409.8django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entirCVE-2022-248418.1fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by tCVE-2022-248428.8MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-adCVE-2022-248437.5Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.5CVE-2022-248448.8Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurCVE-2022-248459.8Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()`CVE-2022-248467.2GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which iCVE-2022-248477.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mech
CVE-2022-24836: High severity, CVSS 7.5 | Vulnix