Skip to content
Fencer Vulns
high 7.5

CVE-2021-37714 json

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

published 2021-08-18 5 y ago modified 2026-10-08 31 d ago also GHSA-m72m-mhq2-9p6c , EUVD-2021-1791

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
6.7%
EPSS 6.7% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Patch / fix

  • maven org.jsoup:jsoup 1.14.2
  • jsoup jsoup 1.14.2
  • oracle stream_analytics 19.1.0.0.6.4
  • jsoup Debian 14, Debian 13, Debian 12 1.14.2-1

debian advisories DEBIAN-CVE-2021-37714

  • eap7-jsoup jboss enterprise application platform 7.4, jboss enterprise application platform 7.3 1.14.2-1.redhat_00002.1.el8eap
  • eap7-wss4j jboss enterprise application platform 7.3 2.2.7-1.redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.3 7.3.10-2.GA_redhat_00003.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.3 3.11.5-1.Final_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3 2.0.41-1.SP1_redhat_00001.1.el8eap
  • eap7-apache-cxf jboss enterprise application platform 7.3 3.3.12-1.redhat_00001.1.el8eap
  • eap7-jakarta-el jboss enterprise application platform 7.3 3.0.3-3.redhat_00007.1.el8eap
  • eap7-ironjacamar jboss enterprise application platform 7.3 1.5.3-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2025:4226RHSA-2021:5151RHSA-2021:5150RHSA-2021:5149RHSA-2021:4677RHSA-2021:4676

  • jsr-305 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 3.0.2-150200.3.3.1
  • jsoup SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 1.14.2-150200.3.3.1

suse advisories SUSE-SU-2022:1265-1

  • jsoup openSUSE Tumbleweed 1.14.2-1.2
  • jsr-305 openSUSE Tumbleweed 3.0.2-1.2

opensuse advisories openSUSE-SU-2024:10882-1openSUSE-SU-2024:10883-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-37714 updated cvss 7.5

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

  • Red Hat BPM Suite 6 jsoup Red Hat Enterprise Linux 7 jsoup, jsoup-javadoc
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 jsoup, jsoup-javadoc
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 jsoup Red Hat Integration Camel Quarkus 1 jsoup
    affected: no fix available
  • Red Hat JBoss A-MQ 6 jsoup Red Hat JBoss BRMS 6 jsoup Red Hat JBoss Data Grid 7 jsoup Red Hat JBoss Data Virtualization 6 jsoup
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack jsoup
    affected: no fix available
  • Red Hat JBoss Fuse 6 jsoup Red Hat JBoss Fuse Service Works 6 jsoup Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: no fix planned “Out of support scope”
  • Red Hat Software Collections rh-maven36-jsoup, rh-maven36-jsoup-javadoc
    affected: no fix planned “Will not fix”
  • Red Hat EAP 7.3.10 GA
    fixed: vendor fix RHSA-2021:5154
show 15 more
  • Red Hat build of Quarkus 2.2.5
    fixed: vendor fix RHSA-2022:0589
  • Red Hat EAP-XP 2 via EAP 7.3.x base
    fixed: vendor fix RHSA-2022:0146
  • Red Hat Fuse 7.10
    fixed: vendor fix RHSA-2021:5134
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wss4j 2.2.7-1.redhat_00001.1.el8eap, eap7-jsoup 1.14.2-1.redhat_00002.1.el8eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el8eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.10-2.GA_redhat_00003.1.el8eap, eap7-wss4j-policy 2.2.7-1.redhat_00001.1.el8eap, +66 more
    fixed: vendor fix RHSA-2021:5151
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wss4j 2.2.7-1.redhat_00001.1.el6eap, eap7-jsoup 1.14.2-1.redhat_00002.1.el6eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el6eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.10-2.GA_redhat_00003.1.el6eap, eap7-wss4j-policy 2.2.7-1.redhat_00001.1.el6eap, +66 more
    fixed: vendor fix RHSA-2021:5149
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wss4j 2.2.7-1.redhat_00001.1.el7eap, eap7-jsoup 1.14.2-1.redhat_00002.1.el7eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el7eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.10-2.GA_redhat_00003.1.el7eap, eap7-wss4j-policy 2.2.7-1.redhat_00001.1.el7eap, +68 more
    fixed: vendor fix RHSA-2021:5150
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jsoup 1.14.2-1.redhat_00002.1.el7eap
    fixed: vendor fix RHSA-2021:4676
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jsoup 1.14.2-1.redhat_00002.1.el8eap
    fixed: vendor fix RHSA-2021:4677
  • Red Hat JBoss Enterprise Application Platform jsoup 1.14.2.redhat-00002
    fixed: vendor fix RHSA-2021:4679
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jsoup 1.14.2-1.redhat_00002.1.ep7.el7, eap7-wildfly 7.1.10-2.GA_redhat_00002.1.ep7.el7, eap7-woodstox-core 5.0.3-2.redhat_00002.1.ep7.el7, eap7-xml-security 2.0.10-2.redhat_00002.1.ep7.el7, eap7-undertow 1.4.18-14.SP13_redhat_00001.1.ep7.el7, eap7-artemis-native 1.5.5.016-1.redhat_00001.1.ep7.el7, +19 more
    fixed: vendor fix RHSA-2025:4226
  • Red Hat Single Sign-On 7.4.10
    fixed: vendor fix RHSA-2021:5170
  • Red Hat RHAF Camel-K 1.8
    fixed: vendor fix RHSA-2022:6407
  • Red Hat RHINT Camel-Q 2.7
    fixed: vendor fix RHSA-2022:5606
  • Red Hat RHPAM 7.13.0 async
    fixed: vendor fix RHSA-2022:5903
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wss4j 2.2.7-1.redhat_00001.1.el7eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el7eap, eap7-wildfly 7.4.2-2.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el7eap, eap7-apache-sshd 2.7.0-1.redhat_00001.1.el7eap, eap7-byte-buddy 1.11.12-2.redhat_00002.1.el7eap, +75 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wss4j 2.2.7-1.redhat_00001.1.el8eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el8eap, eap7-wildfly 7.4.2-2.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el8eap, eap7-apache-sshd 2.7.0-1.redhat_00001.1.el8eap, eap7-byte-buddy 1.11.12-2.redhat_00002.1.el8eap, +73 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1445 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

6.69% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.jsoup:jsoup
<1.14.2
1.14.2

Affected products

  • jhy jsoup

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition
  • CWE-248 Uncaught Exception

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.