CVE-2022-24839

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Apr 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-24847.8The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmwaCVE-2022-248409.8django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entirCVE-2022-248418.1fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by tCVE-2022-248428.8MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-adCVE-2022-248437.5Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.5CVE-2022-248448.8Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurCVE-2022-248459.8Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()`CVE-2022-248467.2GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which iCVE-2022-248477.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechCVE-2022-248488.8DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilityCVE-2022-248496.5DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who haveCVE-2022-24857.5Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its pass