Inefficient Regular Expression Complexity in Nokogiri
Published: April 11, 2022
SECURITY IDENTIFIERS
- CVE: CVE-2022-24836 (NVD)
- GHSA: GHSA-crjr-9rc5-ghw8
- Vendor Advisory: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
GEM
SEVERITY
CVSS v3.x: 7.5 (High)
PATCHED VERSIONS
>= 1.13.4
DESCRIPTION
Summary
Nokogiri < v1.13.4 contains an inefficient regular expression that is
susceptible to excessive backtracking when attempting to detect encoding
in HTML documents.
Mitigation
Upgrade to Nokogiri >= 1.13.4.