Read the docs
TI-2021-15589 Aliases CVE-2021-37714GHSA-m72m-mhq2-9p6c

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

Priority MEDIUM 48CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 15 fixed, 14 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06689 93rd percentileScored 2026-11-07
Fix Partial jsoup (jhy): 1.14.2org.jsoup:jsoup (Maven): 1.14.2Red Hat: 15 advisoriesRed Hat: 15 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jhyjsoupbefore 1.14.21.14.2Patch availableCNA
—org.jsoup:jsoup (Maven)before 1.14.21.14.2Patch availableGHSA-m72m-mhq2-9p6c
  • jsoup Vendorjhy Affected before 1.14.2 Fixed in 1.14.2 Patch available CNA
  • org.jsoup:jsoup (Maven) Vendor— Affected before 1.14.2 Fixed in 1.14.2 Patch available GHSA-m72m-mhq2-9p6c

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:jsoup:jsoup:*:*:*:*:*:*:*:*before 1.14.2VulnerableJsoup
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 2.2.3Vulnerablequarkusio
cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:*14.0.0 – 14.3.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:hospitality_token_proxy_service:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
  • cpe:2.3:a:jsoup:jsoup:*:*:*:*:*:*:*:* Versions before 1.14.2 Vulnerable ·Jsoup
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 2.2.3 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_token_proxy_service:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*21.12VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*17.0 – 19.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*8.0.8.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*8.0.8.3.0VulnerableOracle
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:stream_analytics:*:*:*:*:*:*:*:*before 19.1.0.0.6.4VulnerableOracle
cpe:2.3:a:oracle:stream_analytics:19c:*:*:*:*:*:*:*19cVulnerableOracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* Versions 17.0 – 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:stream_analytics:*:*:*:*:*:*:*:* Versions before 19.1.0.0.6.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:stream_analytics:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle

Remediation

  • Fix · CNA jsoup (jhy) Fixed in 1.14.2
  • Fix · GHSA-m72m-mhq2-9p6c org.jsoup:jsoup (Maven) Fixed in 1.14.2 Advisory →

Red Hat 15 advisories

  • RHSA-2025:4226 Released 2025-04-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
  • RHSA-2022:6407 Released 2022-09-09 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.8 security update
    • RHAF Camel-K 1.8
  • RHSA-2022:5903 Released 2022-08-04 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.13.0 security update
    • RHPAM 7.13.0 async
Show 12 more Red Hat advisories
  • RHSA-2022:5606 Released 2022-07-19 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus 2.7 security update
    • RHINT Camel-Q 2.7
  • RHSA-2022:0589 Released 2022-02-21 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.2.5 release and security update
    • Red Hat build of Quarkus 2.2.5
  • RHSA-2022:0146 Released 2022-01-17 · Red Hat rating Moderate
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2 via EAP 7.3.x base
  • RHSA-2021:5170 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.10 security update
    • Red Hat Single Sign-On 7.4.10
  • RHSA-2021:5149 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-apache-cxf-3.3.12-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el6eap +47
  • RHSA-2021:5151 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-apache-cxf-3.3.12-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el8eap +47
  • RHSA-2021:5154 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.10 security update
    • EAP 7.3.10 GA
  • RHSA-2021:5150 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-apache-cxf-3.3.12-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el7eap +47
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:4677 Released 2021-11-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.7.0-1.redhat_00001.1.el8eap, eap7-jsoup-1.14.2-1.redhat_00002.1.el8eap, eap7-resteasy-3.15.2-1.Final_redhat_00001.1.el8eap +22
  • RHSA-2021:4676 Released 2021-11-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.7.0-1.redhat_00001.1.el7eap, eap7-jsoup-1.14.2-1.redhat_00002.1.el7eap, eap7-resteasy-3.15.2-1.Final_redhat_00001.1.el7eap +24
  • RHSA-2021:4679 Released 2021-11-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.2 security update
    • Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.12.Final-redhat-00001.jar, org.apache.santuario.xmlsec-2.1.7.redhat-00001.jar, org.apache.sshd.sshd-core-2.7.0.redhat-00001.jar +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
EAP 7.3.10 GAFixed RHSA-2021:5154
RHAF Camel-K 1.8Fixed RHSA-2022:6407
RHINT Camel-Q 2.7Fixed RHSA-2022:5606
RHPAM 7.13.0 asyncFixed RHSA-2022:5903
Red Hat EAP-XP 2 via EAP 7.3.x baseFixed RHSA-2022:0146
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:5151
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:5149
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:5150
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2021:4676
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2021:4677
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:4679
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:4226
Red Hat Single Sign-On 7.4.10Fixed RHSA-2021:5170
Red Hat build of Quarkus 2.2.5Fixed RHSA-2022:0589
Not affected: 3 products
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37714
  2. 2026-10-03 Alias added: GHSA-m72m-mhq2-9p6c
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 3

Advisory 5

Other 16

  • TI-2026-52793 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder CVSS 4.0HIGH 8.7
  • TI-2026-50103 jsoup: Cleaner may expose markup with custom raw-text elements CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences