CVE-2022-24839

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.

• CWE-400

• https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773dPatch
• https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmvVendor Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773dPatch
• https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmvVendor Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

Apr 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24832GoCD is an open source a continuous delivery server. The bun…6.8
• CVE-2022-24833PrivateBin is minimalist, open source online pastebin clone …6.1
• CVE-2022-24834Redis is an in-memory database that persists on disk. A spec…8.8
• CVE-2022-24836Nokogiri is an open source XML and HTML library for Ruby. No…7.5
• CVE-2022-24837HedgeDoc is an open-source, web-based, self-hosted, collabor…5.3
• CVE-2022-24838Nextcloud Calendar is a calendar application for the nextclo…9.8
• CVE-2022-2484 The signature check in the Nokia ASIK AirScale system mod…7.8
• CVE-2022-24840django-s3file is a lightweight file upload input for Django …9.8
• CVE-2022-24841fleetdm/fleet is an open source device management, built on …8.1
• CVE-2022-24842MinIO is a High Performance Object Storage released under GN…8.8
• CVE-2022-24843Gin-vue-admin is a backstage management system based on vue …7.5
• CVE-2022-24844Gin-vue-admin is a backstage management system based on vue …8.8