CVE-2022-28366 Denial of service in HtmlUnit-Neko
HighCVSS 7.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| net.sourceforge.htmlunit/neko-htmlunit(Maven) | < 2.27 | 2.27 |
| debian/libowasp-antisamy-java(Debian:12) | All versions | No fix listed |
| debian/libowasp-antisamy-java(Debian:14) | < 1.7.4-1 | 1.7.4-1 |
| debian/libowasp-antisamy-java(Debian:13) | < 1.7.4-1 | 1.7.4-1 |
| net.sourceforge.htmlunit/neko-htmlunit(Maven) | = 2.21 | No fix listed |
| net.sourceforge.htmlunit/neko-htmlunit(Maven) | = 2.23 | No fix listed |
| net.sourceforge.htmlunit/neko-htmlunit(Maven) | = 2.24 | No fix listed |
| net.sourceforge.htmlunit/neko-htmlunit(Maven) | = 2.25 | No fix listed |
| debian/libowasp-antisamy-java(Debian:12) | = 1.5.3+dfsg-1.1 | No fix listed |
| debian/libowasp-antisamy-java(Debian:12) | = 1.7.4-1 | No fix listed |
| debian/libowasp-antisamy-java(Debian:12) | = 1.7.8-1 | No fix listed |
| ubuntu/libowasp-antisamy-java(Ubuntu:22.04) | All versions | No fix listed |
| cyberneko html project cyberneko html | <= 1.9.22 | No fix listed |
| htmlunit | < 2.27 | 2.27 |
| antisamy project antisamy | < 1.6.6 | 1.6.6 |
| ubuntu/libowasp-antisamy-java(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libowasp-antisamy-java(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libowasp-antisamy-java(Ubuntu:26.10) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com release-notes third-party-advisory
- search.maven.org release-notes third-party-advisory
- sourceforge.net release-notes third-party-advisory
- github.com
- Debian Security Tracker CVE-2022-28366 vendor-advisory
- bugs.debian.org issue-tracking
- github.com product
- Ubuntu CVE tracker vendor-advisory
- www.cve.org