Catálogo de CVE

CVE-2022-24839

nekohtml affected and fixed versions

[Catálogo de CVE]

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

Gravedad
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.17% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixienekohtml1.9.22.noko2-0.1FixedDistribution-reported fixed boundary[CVE-2022-24839]
Debiansidnekohtml1.9.22.noko2-0.1FixedDistribution-reported fixed boundary[CVE-2022-24839]
Debiansidnekohtml1.9.22.noko2-1Fixed[CVE-2022-24839]
Debianforkynekohtml1.9.22.noko2-0.1FixedDistribution-reported fixed boundary[CVE-2022-24839]
Debianforkynekohtml1.9.22.noko2-1Fixed[CVE-2022-24839]
Debianbookwormnekohtml1.9.22.noko2-0.1FixedDistribution-reported fixed boundary[CVE-2022-24839]
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormnekohtml1.9.22.noko2-0.1FixedDistribution-reported fixed boundary[CVE-2022-24839]
Debianforkynekohtml1.9.22.noko2-0.1FixedDistribution-reported fixed boundary[CVE-2022-24839]
Debianforkynekohtml1.9.22.noko2-1Fixed[CVE-2022-24839]
Debiansidnekohtml1.9.22.noko2-0.1FixedDistribution-reported fixed boundary[CVE-2022-24839]
Debiansidnekohtml1.9.22.noko2-1Fixed[CVE-2022-24839]
Debiantrixienekohtml1.9.22.noko2-0.1FixedDistribution-reported fixed boundary[CVE-2022-24839]
Original provider fields
{
  "package_releases": [
    {
      "name": "nekohtml",
      "status": "fixed",
      "release": "sid",
      "version": "1.9.22.noko2-1"
    },
    {
      "name": "nekohtml",
      "status": "fixed",
      "release": "forky",
      "version": "1.9.22.noko2-1"
    },
    {
      "name": "nekohtml",
      "status": "fixed",
      "release": "trixie",
      "version": "1.9.22.noko2-0.1"
    },
    {
      "name": "nekohtml",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.9.22.noko2-0.1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1021739,
      "name": "nekohtml",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.9.22.noko2-0.1"
    },
    {
      "bug": 1021739,
      "name": "nekohtml",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.9.22.noko2-0.1"
    },
    {
      "bug": 1021739,
      "name": "nekohtml",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.9.22.noko2-0.1"
    },
    {
      "bug": 1021739,
      "name": "nekohtml",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.9.22.noko2-0.1"
    }
  ],
  "distribution_packages": []
}

[Debian bug #1021739]

OpenFactory catalog packages

La asociación de paquetes está en curso.

[Debian 12 (Bookworm)]

  • [libnekohtml-java]Desconocido

    Paquete fuente: [nekohtml]

    Detalles (2)

    • 1.9.22.noko2-0.1 · all · bookworm

      Corregida · Corregida: 1.9.22.noko2-0.1

      dsa · nekohtml · debian · bookworm

    • 1.9.22.noko2-0.1 · all · bookworm

      Corregida · Corregida: 1.9.22.noko2-0.1

      dsa · nekohtml · debian · bookworm

  • [libnekohtml-java-doc]Desconocido

    Paquete fuente: [nekohtml]

    Detalles (2)

    • 1.9.22.noko2-0.1 · all · bookworm

      Corregida · Corregida: 1.9.22.noko2-0.1

      dsa · nekohtml · debian · bookworm

    • 1.9.22.noko2-0.1 · all · bookworm

      Corregida · Corregida: 1.9.22.noko2-0.1

      dsa · nekohtml · debian · bookworm

Observado:

Referencias

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]