CVE-2022-28366

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.

Published: Apr 22, 2022
Updated: Dec 8, 2023
CVE: CVE-2022-28366
GHSA: GHSA-g9hh-vvx3-v37v
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:N/A:P

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
cyberneko_html_project / cyberneko_html	-	1.9.22.x
antisamy_project / antisamy	-	1.6.6
net.sourceforge.htmlunit / neko-htmlunit	-	2.27
htmlunit / htmlunit	-	2.27

https://github.com/nahsra/antisamy/releases/tag/v1.6.6
https://search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunit
https://sourceforge.net/projects/htmlunit/files/htmlunit/2.27/

Vulnerability Database

289,697

CVE-2022-28366