CVE-2021-37714Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions
Updated under an hour ago ()
Does this affect you?
It affects jhy jsoup and 16 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-835, CWE-248
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
jhy jsoup jhy:jsoup (from the name) | before 1.14.2 | CNA record |
jsoup jsoup jsoup:jsoup | before 1.14.2 | NVD |
quarkus quarkus quarkus:quarkus | through 2.2.3 | NVD |
oracle banking_trade_finance oracle:banking_trade_finance | 14.5 | NVD |
oracle banking_treasury_management oracle:banking_treasury_management | 14.5 | NVD |
oracle business_process_management_suite oracle:business_process_management_suite | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle flexcube_universal_banking oracle:flexcube_universal_banking | from 14.0.0 through 14.3.0; 14.5 | NVD |
oracle hospitality_token_proxy_service oracle:hospitality_token_proxy_service | 19.2 | NVD |
oracle peoplesoft_enterprise_peopletools oracle:peoplesoft_enterprise_peopletools | 8.58; 8.59 | NVD |
oracle primavera_unifier oracle:primavera_unifier | 20.12; 21.12 | NVD |
oracle retail_customer_management_and_segmentation_foundation oracle:retail_customer_management_and_segmentation_foundation | from 17.0 through 19.0 | NVD |
oracle webcenter_portal oracle:webcenter_portal | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle communications_messaging_server oracle:communications_messaging_server | 8.1 | NVD |
netapp management_services_for_element_software_and_netapp_hci netapp:management_services_for_element_software_and_netapp_hci | all versions | NVD |
oracle financial_services_crime_and_compliance_management_studio oracle:financial_services_crime_and_compliance_management_studio | 8.0.8.2.0; 8.0.8.3.0 | NVD |
oracle middleware_common_libraries_and_tools oracle:middleware_common_libraries_and_tools | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle stream_analytics oracle:stream_analytics | before 19.1.0.0.6.4; 19c | NVD |
References
- https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6cx-refsource-confirm
- https://jsoup.org/news/release-1.14.1x-refsource-misc
- https://jsoup.org/news/release-1.14.2x-refsource-misc
- https://lists.apache.org/thread.html/r685c5235235ad0c26e86d0ee987fb802c9675de6081dbf0516464e0b%40%3Cnotifications.james.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rc3354080fc67fb50b45b3c2d12dc4ca2a3c1c78dad3d3ba012c038aa%40%3Cnotifications.james.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r97404676a5cf591988faedb887d64e278f522adcaa823d89ca69defe%40%3Cnotifications.james.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r50e9c9466c592ca9d707a5dea549524d19e3287da08d8392f643960e%40%3Cissues.maven.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r215009dbf7467a9f6506d0c0024cb36cad30071010e62c9352cfaaf0%40%3Cissues.maven.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r3d71f18adb78e50f626dde689161ca63d3b7491bd9718fcddfaecba7%40%3Cissues.maven.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r377b93d79817ce649e9e68b3456e6f499747ef1643fa987b342e082e%40%3Cissues.maven.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpuapr2022.htmlx-refsource-misc
- https://security.netapp.com/advisory/ntap-20220210-0022/x-refsource-confirm
- https://www.oracle.com/security-alerts/cpujul2022.htmlx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.