RHLW-2026-1af9ecf859c7dfb4: Lightwell Security Advisory: jsoup 1.17.1.rhlw-00007
Red Hat Lightwell has released org.jsoup:jsoup 1.17.1.rhlw-00007 with backported fixes for CVE-2026-71497 and CVE-2026-75140.
CVE-2026-71497: jsoup: Cleaner may expose markup with custom raw-text elements
CVE-2026-75140: jsoup Uncontrolled Resource Consumption in XmlTreeBuilder
This patched artifact is a drop-in replacement for org.jsoup:jsoup 1.17.1 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.jsoup:jsoupto a version that resolves this vulnerability.Fixed in 1.17.1.rhlw-00007 - Upgrade
Upgrade
org.jsoup:jsoupto a version that resolves this vulnerability.Fixed in 1.17.1.rhlw-00007
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit the reported issues?
The supplied vector indicates network reachability, high attack complexity, no required privileges, and required user interaction. It also indicates potential low confidentiality and integrity impact, with no availability impact listed.
What remediation is available for deployments using jsoup 1.17.1?
Red Hat Lightwell provides org.jsoup:jsoup 1.17.1.rhlw-00007 with backported fixes for both listed CVEs. The advisory states that this artifact is a drop-in replacement for org.jsoup:jsoup 1.17.1 from Maven Central.