Denial of service in HtmlUnit
Priority LOW 35CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.
Why it matters now
EPSS 0.00907 60th percentileScored 2026-11-07
Fix Partial htmlunit: 2.70.0org.htmlunit:htmlunit (Maven): 2.70.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | htmlunit | before 2.70.0 | 2.70.0 | Patch available | CNA |
| — | org.htmlunit:htmlunit (Maven) | before 2.70.0 | 2.70.0 | Patch available | GHSA-rc44-5cmh-879m |
- htmlunit Vendor— Affected before 2.70.0 Fixed in 2.70.0 Patch available CNA
- org.htmlunit:htmlunit (Maven) Vendor— Affected before 2.70.0 Fixed in 2.70.0 Patch available GHSA-rc44-5cmh-879m
Remediation
- Fix · CNA htmlunit Fixed in 2.70.0
- Fix · GHSA-rc44-5cmh-879m org.htmlunit:htmlunit (Maven) Fixed in 2.70.0 Advisory →
Red Hat 2 advisories
- RHSA-2023:4627 Released 2023-08-14 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
- RHSA-2023:3814 Released 2023-06-27 · Red Hat rating ModerateMigration Toolkit for Runtimes security update
- Migration Toolkit for Runtimes 1 on RHEL 8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix yet |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2023:4627 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2023:3814 |
Not affected: 11 products
- MTA 6.2 for RHEL 8
- Migration Toolkit for Runtimes
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 2
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Application Runtimes
- Red Hat Single Sign-On 7
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2798
- 2026-10-03 Alias added: GHSA-rc44-5cmh-879m
References
More Htmlunit vulnerabilities
- TI-2023-26758 HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL CVSS 3.1CRITICAL 9.8
- TI-2023-11344 Code injection in net.sourceforge.htmlunit:htmlunit CVSS 3.1CRITICAL 9.8
- TI-2020-04499 Code injection in HtmlUnit CVSS 3.1HIGH 8.1
- TI-2022-11120 Certain Neko-related HTML parsers allow a denial of service via crafted Processing… CVSS 3.1HIGH 7.5
- TI-2022-12000 HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. CVSS 3.1HIGH 7.5
Sources
- CVE-2023-2798 · CVE Program
- CVE-2023-2798 · NVD
- FIRST EPSS
- GHSA-rc44-5cmh-879m · GitHub Advisory Database · CC BY 4.0
- CVE-2023-2798 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences