Skip to content
Fencer Vulns
high 7.5

CVE-2026-75140 json

jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

published 2026-08-20 2 mo ago modified 2026-11-08 22 h ago also EUVD-2026-63476 , GHSA-65r4-943x-97jj

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

Patch / fix

  • maven org.jsoup:jsoup 1.23.2
  • jsoup Debian 14 1.23.2-1

debian advisories DEBIAN-CVE-2026-75140

  • jsoup SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.23.2-150200.3.14.1
  • jsoup SLES 16.0, SLES for SAP applications 16.0 1.23.2-160000.1.1

suse advisories SUSE-SU-2026:4393-1SUSE-SU-2026:23856-1SUSE-SU-2026:23867-1

  • re2j openSUSE Leap 16.0 1.8-160000.1.1
  • jsoup openSUSE Leap 16.0 1.23.2-160000.1.1
  • jsoup openSUSE Tumbleweed 1.23.2-1.1

opensuse advisories openSUSE-SU-2026:21900-1openSUSE-SU-2026:11702-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-75140 updated cvss 7.5

org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents

  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9, exploit-intelligence/vulnerability-analysis-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, mta/mta-java-external-provider-rhel9 Red Hat OpenShift Developer Tools and Services jenkins-2-plugins 4.19.1758207171-1.el9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 7 maven-wagon-scm, maven-wagon-javadoc, maven-wagon 2.4-3.el7, maven-wagon-provider-test Red Hat Enterprise Linux 8 maven-wagon, maven-wagon-ftp, maven-wagon-file, maven-wagon-http, maven-wagon-javadoc, maven-wagon-providers, +3 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 jmc
    affected: workaround, no fix available
  • Red Hat JBoss Enterprise Application Platform 7 jsoup 1.17.2.redhat-00002, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat OpenStack Platform 13 (Queens) opendaylight Red Hat Single Sign-On 7 jsoup 1.17.2.redhat-00002
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1792044326
    fixed: vendor fix RHSA-2026:88152
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1792044327
    fixed: vendor fix RHSA-2026:88149
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1792044382
    fixed: vendor fix RHSA-2026:88151
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1792044386
    fixed: vendor fix RHSA-2026:88150
show 14 more
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1792040287
    fixed: vendor fix RHSA-2026:88156
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1792040131
    fixed: vendor fix RHSA-2026:88159
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1792041514
    fixed: vendor fix RHSA-2026:88153
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1792040733
    fixed: vendor fix RHSA-2026:88158
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1792040081
    fixed: vendor fix RHSA-2026:88157
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1792040096
    fixed: vendor fix RHSA-2026:88155
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1792040428
    fixed: vendor fix RHSA-2026:88154
  • Red Hat build of Quarkus 3.27.5.SP2
    fixed: vendor fix RHSA-2026:69470
  • Red Hat build of Quarkus 3.33.3.SP2
    fixed: vendor fix RHSA-2026:69440
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-agent-base-rhel8 1792044376 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-agent-base-rhel8 1792044361 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-agent-base-rhel8 1792044402 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-agent-base-rhel8 1792044379 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-agent-base-rhel9 1792040156 Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-agent-base-rhel9 1792040149
    +5 more products
    Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-agent-base-rhel9 1792041201 Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-agent-base-rhel9 1792040114 Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-agent-base-rhel9 1792040274 Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-agent-base-rhel9 1792039948 Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-agent-base-rhel9 1792040297
    not affected: vulnerable code not present
  • Red Hat AMQ Broker 7 jsoup 1.17.2.redhat-00002
    not affected: vulnerable code not in execute path
  • Red Hat build of Apicurio Registry 3 jsoup 1.17.2.redhat-00002 Red Hat Enterprise Linux 9 sisu, guava, jansi, maven, slf4j, jsr-305, +30 more Red Hat Enterprise Linux 10 jsoup 1.17.2-4.el10, jakarta-mail 2.1.2-6.el10
    not affected: component not present
  • Red Hat Fuse 7 jsoup 1.17.2.redhat-00002
    not affected: vulnerable code not in execute path
  • Red Hat Hardened Images maven3.9 3.9.16-0.1.hum1
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
maven org.jsoup:jsoup
<1.23.2
1.23.2

Affected products

  • jhy soup

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.