ADVISORIES

• CVE-2022-24836 (NVD)
• GHSA-crjr-9rc5-ghw8
• Vendor Advisory

GEM

nokogiri

SEVERITY

CVSS v3.x: 7.5 (High)

PATCHED VERSIONS

• >= 1.13.4

DESCRIPTION

Summary

Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.

Mitigation

Upgrade to Nokogiri >= 1.13.4.

RELATED

• https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd
• https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
• https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ