Read the docs
TI-2026-52793 Aliases CVE-2026-75140GHSA-65r4-943x-97jj

jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

Priority MEDIUM 44CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 13 fixed, 9 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00525 44th percentileScored 2026-11-07
Fix Partial org.jsoup:jsoup (Maven): 1.23.2Red Hat: 13 advisoriesRed Hat: 13 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jhysoupup to 1.23.1—Patch availableCNA
—org.jsoup:jsoup (Maven)before 1.23.21.23.2Patch availableGHSA-65r4-943x-97jj
  • soup Vendorjhy Affected up to 1.23.1 Fixed in — Patch available CNA
  • org.jsoup:jsoup (Maven) Vendor— Affected before 1.23.2 Fixed in 1.23.2 Patch available GHSA-65r4-943x-97jj

Remediation

  • Fix · GHSA-65r4-943x-97jj org.jsoup:jsoup (Maven) Fixed in 1.23.2 Advisory →

Red Hat 13 advisories

  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 10 more Red Hat advisories
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:69440 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP2 release and security update
    • Red Hat build of Quarkus 3.33.3.SP2
  • RHSA-2026:69470 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP2 release and security update
    • Red Hat build of Quarkus 3.27.5.SP2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat build of Quarkus 3.27.5.SP2Fixed RHSA-2026:69470
Red Hat build of Quarkus 3.33.3.SP2Fixed RHSA-2026:69440
Not affected: 17 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat AMQ Broker 7
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat build of Apicurio Registry 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75140
  2. 2026-10-03 Alias added: GHSA-65r4-943x-97jj
  3. 2026-10-06 Fix available: Maven/org.jsoup:[email protected] · GHSA-65r4-943x-97jj
  4. 2026-10-06 CVSS score added · GHSA-65r4-943x-97jj
  5. 2026-10-06 Weakness changed · GHSA-65r4-943x-97jj
  6. 2026-10-06 5 new references · GHSA-65r4-943x-97jj
  7. 2026-10-09 Fix available: RHSA-2026:69440 · Red Hat
  8. 2026-10-09 Fix available: RHSA-2026:69470 · Red Hat
  9. 2026-10-09 Fix available: Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2 · Red Hat
  10. 2026-10-16 Affected versions changed · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  22. 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat

References

Patch 2

Advisory 1

Other 2

  • TI-2026-50103 jsoup: Cleaner may expose markup with custom raw-text elements CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences