CVE-2022-28366: Denial of Service in HtmlUnit-Neko
Summary
CVE-2022-28366: Denial of service in HtmlUnit-Neko. Affects net.sourceforge.htmlunit:neko-htmlunit versions < 2.27. Fixed in 2.27. How to fix ↓
Also tracked for
- libowasp-antisamy-java · Debian:11
The same CVE-2022-28366 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HtmlUnit-Neko is an HTML parsing library used in various applications. It provides functionality to parse and process HTML documents. However, certain versions of HtmlUnit-Neko, including 2.26, are vulnerable to a denial of service attack. This vulnerability can be exploited by providing crafted Processing Instruction (PI) input, leading to excessive heap memory consumption. The issue also affects CyberNeko HTML versions up to 1.9.22, which includes OWASP AntiSamy before 1.6.6. It is important to note that 1.9.22 is the last version of CyberNeko HTML.
Vulnerability Detail
The vulnerability allows an attacker to cause a denial of service by exploiting the way certain Neko-related HTML parsers handle Processing Instruction (PI) input. By providing specially crafted input, an attacker can trigger excessive heap memory consumption, leading to the application becoming unresponsive or crashing. This vulnerability has a CVSS score of 7.5, indicating a high severity level. It is recommended to update to HtmlUnit-Neko version 2.27 or later to mitigate this issue.
How To Fix
Minimum fixed version
2.27
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to the fixed version of HtmlUnit-Neko (2.27 or later) to address the issue.
Conclusion
The vulnerability in HtmlUnit-Neko allows an attacker to cause a denial of service by exploiting the way certain HTML parsers handle Processing Instruction input. To mitigate this issue, it is recommended to update to HtmlUnit-Neko version 2.27 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for net.sourceforge.htmlunit:neko-htmlunit →
FAQ
HtmlUnit-Neko is an HTML parsing library used in various applications to parse and process HTML documents.
This vulnerability allows an attacker to cause a denial of service by consuming excessive heap memory, leading to application unresponsiveness or crashes.
HtmlUnit-Neko versions up to 2.26 are affected. Additionally, CyberNeko HTML versions up to 1.9.22 are also vulnerable.
No, there is no known workaround. Updating to the fixed version of HtmlUnit-Neko is necessary.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for net.sourceforge.htmlunit:neko-htmlunit.
