GHSA-gx8x-g87m-h5q6 Denial of Service (DoS) in Nokogiri on JRuby
An attacker can cause a denial of service by providing ill-formed HTML markup to the Nokogiri library on JRuby, leading to an OutOfMemoryError.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-gx8x-g87m-h5q6?
GHSA-gx8x-g87m-h5q6 is a denial of service vulnerability in nokogiri, published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
Nokogiri v1.13.4 updates the vendored org.cyberneko.html library to 1.9.22.noko2 which addresses CVE-2022-24839. That CVE is rated 7.5 (High Severity).
See GHSA-9849-p7jc-9rmv for more information.
Please note that this advisory only applies to the JRuby implementation of Nokogiri < 1.13.4.
Mitigation
Upgrade to Nokogiri >= 1.13.4.
Impact
CVE-2022-24839 in nekohtml
- Severity: High 7.5
- Type: CWE-400 Uncontrolled Resource Consumption
- Description: The fork of
org.cyberneko.htmlused by Nokogiri (Rubygem) raises ajava.lang.OutOfMemoryErrorexception when parsing ill-formed HTML markup. - See also: GHSA-9849-p7jc-9rmv
Which versions are affected by GHSA-gx8x-g87m-h5q6?
2 open source packages ship an affected version, including nokogiri.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | All versions | 1.13.4 |
nokogiri RubyGems | All versions | 1.13.4 |
How do I fix GHSA-gx8x-g87m-h5q6?
Upgrade nokogiri to 1.13.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-gx8x-g87m-h5q6 being exploited?
There is no known exploitation of GHSA-gx8x-g87m-h5q6 in the wild and no public exploit code.