GHSA-65r4-943x-97jj: Maven/org.jsoup:jsoup vulnerability

Q: Which applications are exposed to this issue?

Applications using jsoup through version 1.23.2 are exposed when they parse attacker-controlled XML with XmlTreeBuilder. The practical impact is JVM heap exhaustion, potentially terminating the application with an OutOfMemoryError.

Q: What does an attacker need to supply to trigger the problem?

An attacker needs to provide a deeply nested XML document whose elements use unique namespaces. This causes XmlTreeBuilder to repeatedly copy inherited namespace maps, resulting in quadratic time and memory consumption.

Q: Is this limited to a particular deployment configuration?

The available information identifies the vulnerable path as XmlTreeBuilder processing malicious XML; it does not identify any configuration prerequisite or mitigation that disables the issue. Exposure therefore depends on whether the application parses untrusted XML through that builder.

Q: What should be done if upgrading cannot happen immediately?

The provided data does not specify a temporary configuration workaround. Reduce exposure by preventing untrusted XML from reaching XmlTreeBuilder, particularly deeply nested documents with uniquely namespaced elements, until the fix in commit 862ba2f is applied.

Published Aug 20, 2026

Updated

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

Affected Software

1 affected componentFixes available

maven/org.jsoup:jsoup<1.23.2

1.23.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/org.jsoup:jsoup to a version that resolves this vulnerability.
Fixed in 1.23.2
Upgrade
Upgrade jsoup to a version that resolves this vulnerability.
Patch 862ba2f

Event History

Aug 20, 2026

Advisory Published

via GitHub·06:30 PM

Data Sourced

via GitHub·06:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using jsoup through version 1.23.2 are exposed when they parse attacker-controlled XML with XmlTreeBuilder. The practical impact is JVM heap exhaustion, potentially terminating the application with an OutOfMemoryError.

What does an attacker need to supply to trigger the problem?

An attacker needs to provide a deeply nested XML document whose elements use unique namespaces. This causes XmlTreeBuilder to repeatedly copy inherited namespace maps, resulting in quadratic time and memory consumption.

Is this limited to a particular deployment configuration?

The available information identifies the vulnerable path as XmlTreeBuilder processing malicious XML; it does not identify any configuration prerequisite or mitigation that disables the issue. Exposure therefore depends on whether the application parses untrusted XML through that builder.

What should be done if upgrading cannot happen immediately?

The provided data does not specify a temporary configuration workaround. Reduce exposure by preventing untrusted XML from reaching XmlTreeBuilder, particularly deeply nested documents with uniquely namespaced elements, until the fix in commit 862ba2f is applied.

GHSA-65r4-943x-97jj: Maven/org.jsoup:jsoup vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to supply to trigger the problem?

Is this limited to a particular deployment configuration?

What should be done if upgrading cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to supply to trigger the problem?

Is this limited to a particular deployment configuration?

What should be done if upgrading cannot happen immediately?