CVE-2022-29546

HighCVSS 7.5

Published: 25/04/2022(UTC)Updated: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.23%

69th percentile - higher than 69% of all known CVEs

Summary

The NekoHtml parser in HtmlUnit before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption; this is similar to CVE-2022-28366 but affects a much later version of the product.

Risk Assessment

An attacker can cause memory exhaustion and unavailability of an application processing untrusted HTML, posing a risk to public-facing services.

Recommendation

Update HtmlUnit to version 2.61.0 or later and consider limiting the size and complexity of processed HTML.

Other vulnerabilities in HtmlUnit

CVE-2023-26119Critical
Vulnerability in the package net.sourceforge.htmlunit:htmlunit before version 3.0.0 allows remote code execution (RCE) via XSTL when browsing the attacker's webpage.

Original NVD description (English source)

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS