High severity7.5NVD Advisory· Published Apr 21, 2022· Updated Jun 17, 2026
CVE-2022-28366
CVE-2022-28366
Description
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
net.sourceforge.htmlunit:neko-htmlunitMaven | < 2.27 | 2.27 |
Affected products
2- Neko/Neko HTML parsersdescription
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-g9hh-vvx3-v37vghsaADVISORY
- github.com/nahsra/antisamy/releases/tag/v1.6.6nvdRelease NotesThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-28366ghsaADVISORY
- search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunitnvdRelease NotesThird Party AdvisoryWEB
- sourceforge.net/projects/htmlunit/files/htmlunit/2.27/nvdRelease NotesThird Party Advisory
- sourceforge.net/projects/htmlunit/files/htmlunit/2.27ghsaWEB
News mentions
0No linked articles in our index yet.