CVE-2026-75140: jsoup Uncontrolled Resource Consumption in XmlTreeBuilder
jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsoupto a version that resolves this vulnerability.Fixed in 1.23.2Patch 862ba2f
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using jsoup through version 1.23.2 are exposed when they parse remotely supplied XML through XmlTreeBuilder. The issue can exhaust the JVM heap and terminate the application.
Does exploitation require authentication or user interaction?
No. The reported vector is network-accessible, with low attack complexity, no privileges required, and no user interaction required.
How can I determine whether a deployment needs remediation?
Check whether the application includes jsoup version 1.23.2 or earlier and processes XML from remote sources. The issue is fixed by commit 862ba2f1d48ee95609183dbcfc848c9fd7afc76a.