CVE-2021-37714
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
jsoup is a Java library for working with HTML. Using versions prior to 1.14.2 to parse untrusted HTML or XML may lead to DoS attacks — the parser may get stuck, run slower, or throw an unexpected exception.
Risk Assessment
An attacker can supply malicious content, causing resource exhaustion and unavailability of the parsing service.
Recommendation
Upgrade jsoup to version 1.14.2 or later. As workarounds, apply input size limits, rate limiting, or thread watchdogs.
Other vulnerabilities in jsoup
See all- CVE-2026-75140High
The jsoup library through version 1.23.2 contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder. A remote attacker can supply a deeply nested XML document with uniquely-namespaced elements, causing quadratic time and memory complexity, leading to JVM heap exhaustion and application termination.
- CVE-2026-71497Medium
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.
- CVE-2015-6748Medium
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
Original NVD description (English source)
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS