jsoup: Cleaner may expose markup with custom raw-text elements
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 17 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jhy | jsoup | 1.14.3 to before 1.23.1 | 1.23.1 | Patch available | CNA |
| — | org.jsoup:jsoup (Maven) | 1.14.3 to before 1.23.1 | 1.23.1 | Patch available | GHSA-pmhh-3w7g-xqp8 |
- jsoup Vendorjhy Affected 1.14.3 to before 1.23.1 Fixed in 1.23.1 Patch available CNA
- org.jsoup:jsoup (Maven) Vendor— Affected 1.14.3 to before 1.23.1 Fixed in 1.23.1 Patch available GHSA-pmhh-3w7g-xqp8
Remediation
- Fix · CNA jsoup (jhy) Fixed in 1.23.1
- Fix · GHSA-pmhh-3w7g-xqp8 org.jsoup:jsoup (Maven) Fixed in 1.23.1 Advisory →
Red Hat 2 advisories
- RHSA-2026:69440 Released 2026-09-21 · Red Hat rating ImportantRed Hat build of Quarkus 3.33.3.SP2 release and security update
- Red Hat build of Quarkus 3.33.3.SP2
- RHSA-2026:69470 Released 2026-09-21 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.5.SP2 release and security update
- Red Hat build of Quarkus 3.27.5.SP2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus Native builder | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus 3.27.5.SP2 | Fixed | RHSA-2026:69470 |
| Red Hat build of Quarkus 3.33.3.SP2 | Fixed | RHSA-2026:69440 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71497
- 2026-10-03 Alias added: GHSA-pmhh-3w7g-xqp8
- 2026-10-09 Fix available: RHSA-2026:69440 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:69470 · Red Hat
- 2026-10-24 Fix available: Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2 · Red Hat
References
More jhy vulnerabilities
- TI-2026-52793 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder CVSS 4.0HIGH 8.7
Sources
- CVE-2026-71497 · CVE Program
- CVE-2026-71497 · NVD
- FIRST EPSS
- GHSA-pmhh-3w7g-xqp8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-71497 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences