RHLW-2026-dc6bb5cbbfc647ed: Lightwell Security Advisory: jsoup 1.22.1.rhlw-00002
Red Hat Lightwell has released org.jsoup:jsoup 1.22.1.rhlw-00002 with backported fixes for CVE-2026-71497 and CVE-2026-75140.
CVE-2026-71497: jsoup: Cleaner may expose markup with custom raw-text elements
CVE-2026-75140: jsoup Uncontrolled Resource Consumption in XmlTreeBuilder
This patched artifact is a drop-in replacement for org.jsoup:jsoup 1.22.1 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.jsoup:jsoupto a version that resolves this vulnerability.Fixed in 1.22.1.rhlw-00002 - Upgrade
Upgrade
org.jsoup:jsoupto a version that resolves this vulnerability.Fixed in 1.22.1.rhlw-00002
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which jsoup dependency can be replaced with this release?
The Red Hat Lightwell artifact is a drop-in replacement for org.jsoup:jsoup 1.22.1 obtained from Maven Central. It is identified as org.jsoup:jsoup 1.22.1.rhlw-00002.
Which issues are addressed by the patched artifact?
It includes backported fixes for CVE-2026-71497, involving Cleaner handling of custom raw-text elements that may expose markup, and CVE-2026-75140, involving uncontrolled resource consumption in XmlTreeBuilder.