CVE-2022-28366

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption

published April 21, 2022

CVSS
—
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02166 · 82.0th percentile
Published
2022-04-21T22:41Z
EPSS history
Timeline
  • 21 APR 22:41Z
    Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption
    cvelistv5