Login Request a demo
High severity · published Apr 21, 2022
CVE-2022-28366
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Antisamy · Antisamy Project
before 1.6.6 · source: NVD
CH
Cyberneko Html · Cyberneko Html Project
through 1.9.22 · source: NVD
HT
Htmlunit · Htmlunit
before 2.27 · source: NVD
Affected product
AN
Antisamy
Antisamy Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-28366
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-28366
Release Notes
https://github.com/nahsra/antisamy/releases/tag/v1.6.6
Release Notes
https://search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunit
Release Notes
https://sourceforge.net/projects/htmlunit/files/htmlunit/2.27/
More from Antisamy
6.1
CVE-2024-23635
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources
6.1
CVE-2023-43643
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources
6.1
CVE-2022-28367
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input
6.1
CVE-2022-29577
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input
6.1
CVE-2021-35043
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected)