GHSA-6jmm-mp6w-4rrg

Source

https://github.com/advisories/GHSA-6jmm-mp6w-4rrg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-6jmm-mp6w-4rrg/GHSA-6jmm-mp6w-4rrg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6jmm-mp6w-4rrg

Aliases

CVE-2022-29546

Published

2022-04-26T21:14:57Z

Modified

2023-11-08T04:09:13.642010Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser

Details

Impact

NekoHtml Parser suffers from a denial of service vulnerability on versions 2.60.0 and below. A specifically crafted input regarding the parsing of processing instructions leads to heap memory consumption. Please update to version 2.61.0.

For more information

If you have any questions or comments about this advisory: * Open an issue in https://github.com/HtmlUnit/htmlunit-neko * Email us at [rbri at rbri.de]

Database specific

{
    "nvd_published_at": "2022-04-25T03:15:00Z",
    "github_reviewed_at": "2022-04-26T21:14:57Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-400"
    ]
}

References

Affected packages

Maven / net.sourceforge.htmlunit:neko-htmlunit

Package

Name: net.sourceforge.htmlunit:neko-htmlunit; View open source insights on deps.dev
Purl: pkg:maven/net.sourceforge.htmlunit/neko-htmlunit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.61.0

Affected versions

2.*

2.21

2.23

2.24

2.25

2.27

2.28

2.30

2.31

2.32

2.33

2.34.0

2.35.0

2.36.0

2.37.0

2.38.0

2.39.0

2.40.0

2.41.0

2.42.0

2.43.0

2.44.0

2.45.0

2.46.0

2.47.0

2.47.1

2.48.0

2.49.0

2.50.0

2.51.0

2.52.0

2.53.0

2.54.0

2.55.0

2.56.0

2.57.0

2.58.0

2.59.0

2.60.0