CVE-2023-2798 Denial of service in HtmlUnit
An attacker can cause a denial of service by triggering a stack overflow in HtmlUnit when browsing untrusted webpages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-2798?
CVE-2023-2798 is a high-severity denial of service vulnerability in htmlunit:htmlunit, published on 25 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.
Which versions are affected by CVE-2023-2798?
2 open source packages ship an affected version, including org.htmlunit:htmlunit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.htmlunit:htmlunit Maven | All versions | 2.70.0 |
org.htmlunit:htmlunit Maven | All versions | 2.70.0 |
Products include Htmlunit Htmlunit.
How do I fix CVE-2023-2798?
Upgrade org.htmlunit:htmlunit to 2.70.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-2798 being exploited?
There is no known exploitation of CVE-2023-2798 in the wild and no public exploit code.
Other vulnerabilities in htmlunit:htmlunit
Sources
Also known as GHSA-rc44-5cmh-879m, UBUNTU-CVE-2023-2798.