CVE-2022-28366

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.

• https://github.com/nahsra/antisamy/releases/tag/v1.6.6Release Notes, Third Party Advisory
• https://search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunitRelease Notes, Third Party Advisory
• https://sourceforge.net/projects/htmlunit/files/htmlunit/2.27/Release Notes, Third Party Advisory
• https://github.com/nahsra/antisamy/releases/tag/v1.6.6Release Notes, Third Party Advisory
• https://search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunitRelease Notes, Third Party Advisory
• https://sourceforge.net/projects/htmlunit/files/htmlunit/2.27/Release Notes, Third Party Advisory

Published

Apr 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28355randomUUID in Scala.js before 1.10.0 generates predictable v…7.5
• CVE-2022-28356In the Linux kernel before 5.17.1, a refcount leak bug was f…5.5
• CVE-2022-28357NATS nats-server 2.2.0 through 2.7.4 allows directory traver…9.8
• CVE-2022-28363Reprise License Manager 14.2 is affected by a reflected cros…6.1
• CVE-2022-28364Reprise License Manager 14.2 is affected by a reflected cros…5.4
• CVE-2022-28365Reprise License Manager 14.2 is affected by an Information D…5.3
• CVE-2022-28367OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smugglin…6.1
• CVE-2022-28368Dompdf 1.2.1 allows remote code execution via a .php file in…9.8
• CVE-2022-28369Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not…9.8
• CVE-2022-2837A flaw was found in coreDNS. This flaw allows a malicious us…6.1
• CVE-2022-28370On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devi…7.5
• CVE-2022-28371On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and O…7.5