Denial of Service Vulnerability in libowasp-antisamy-java and HtmlUnit-Neko
Summary
CVE-2022-28366: Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. Affects libowasp-antisamy-java across 2 version ranges.
< 99b1143bd2219c7645a8d68ca856a51e67f7bbfa
< 7421f043d18741c4e36bf7c0ce8b471122dbf18a
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libowasp-antisamy-java is a Java library used for sanitizing HTML input to prevent XSS attacks. It relies on HTML parsers like HtmlUnit-Neko for processing HTML content. The vulnerability in question affects these parsers, leading to potential denial of service through excessive memory consumption when handling crafted Processing Instruction (PI) inputs.
Vulnerability Detail
The vulnerability, identified as CVE-2022-28366, arises from certain Neko-related HTML parsers that allow a denial of service due to crafted Processing Instruction (PI) input. This input can cause excessive heap memory consumption, leading to application crashes or slowdowns. The issue is present in HtmlUnit-Neko versions up to 2.26 and CyberNeko HTML through version 1.9.22, which also affects OWASP AntiSamy before version 1.6.6. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to filter out potentially harmful Processing Instructions before they reach the HTML parser. This can be done by sanitizing input strings and rejecting any that contain suspicious patterns.
Conclusion
CVE-2022-28366 is a significant vulnerability affecting libowasp-antisamy-java and related HTML parsers, leading to potential denial of service. It is crucial to update to the latest versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
CVE-2022-28366 is a vulnerability in certain HTML parsers that can lead to denial of service due to excessive memory consumption from crafted input.
The affected packages include libowasp-antisamy-java, HtmlUnit-Neko, and CyberNeko HTML.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If you cannot upgrade immediately, implement input validation to filter out potentially harmful Processing Instructions.
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
