CVE-2022-28366
High
Description
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
SeverityHigh
CVSS7.5
Exploit probability—
ProductCyberneko Html
PublishedApr 21, 2022
First seenApr 21, 2022
How to fix
Update
- htmlunit htmlunit2.27 or later
- antisamy_project antisamy1.6.6 or later
- net.sourceforge.htmlunit:neko-htmlunit2.27 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cyberneko_html_project cyberneko_html | v ≤ 1.9.22 | — |
| htmlunit htmlunit | v < 2.27 | 2.27 |
| antisamy_project antisamy | v < 1.6.6 | 1.6.6 |
| net.sourceforge.htmlunit:neko-htmlunitMaven | v < 2.27 | 2.27 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.