Description
jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jhy | soup | ≤ 1.23.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jsoup | 1.23.2-1 | — |
| Debian 13 | jsoup | No fix yet | — |
| Debian 12 | jsoup | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jsoup | No fix yet | — |
| Ubuntu 26.04 LTS | jsoup | No fix yet | — |
| Ubuntu 24.04 LTS | jsoup | No fix yet | — |
| Ubuntu 22.04 LTS | jsoup | No fix yet | — |
| Ubuntu 20.04 LTS | jsoup | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | jsoup | No fix yet | — |
| Ubuntu 16.04 LTS | jsoup | No fix yet | — |
| Ubuntu Pro 14.04 LTS | jsoup | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
| SLES 15 SP6 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
| SLES 15 SP5 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
| SLES 15 SP4 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | jsoup | 1.23.2-160000.1.1 | SUSE-SU-2026:23867-1, SUSE-SU-2026:23856-1 |
| SLES for SAP 15 SP6 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
| SLES for SAP 15 SP5 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
| SLES for SAP 15 SP4 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
| SLES 16.0 | jsoup | 1.23.2-160000.1.1 | SUSE-SU-2026:23867-1, SUSE-SU-2026:23856-1 |
| SLE HPC 15 SP5 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
| SLE HPC 15 SP4 | jsoup | 1.23.2-150200.3.14.1 | SUSE-SU-2026:4393-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jsoup | 1.23.2-1.1 | openSUSE-SU-2026:11702-1 |
| openSUSE Leap 16.0 | jsoup | 1.23.2-160000.1.1 | openSUSE-SU-2026:21900-1 |
| openSUSE Leap 16.0 | re2j | 1.8-160000.1.1 | openSUSE-SU-2026:21900-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | jsoup | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-tika-3.1 | 3.1.0-r42 | — |
| Wolfi rolling | apache-tika-3.2 | 3.2.3-r21 | — |
| Wolfi rolling | apache-tika-3.3 | 3.3.2-r5 | — |
| Wolfi rolling | nextflow | 26.04.6-r5 | — |
| Wolfi rolling | opensearch-3-reporting +1 | 3.9.0-r3 | — |
| Wolfi rolling | scala-3.8 +1 | No fix yet | — |
| Wolfi rolling | scala-3.9 | 3.9.0-r2 | — |
| Wolfi rolling | spdx-tools-java | 2.0.7-r9 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jsoup:jsoup | < 1.23.2 | 1.23.2 | GHSA-65r4-943x-97jj |
Advisories 8
- WID-SEC-2026-4056 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-4089 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- SUSE-SU-2026:4393-1 Security update for jsoup, re2j SUSE / openSUSE Security Updates · Sep 30, 2026
- SUSE-SU-2026:23856-1 Security update for jsoup, re2j SUSE / openSUSE Security Updates · Sep 27, 2026
- SUSE-SU-2026:23867-1 Security update for jsoup, re2j SUSE / openSUSE Security Updates · Sep 27, 2026
- openSUSE-SU-2026:21900-1 Security update for jsoup, re2j SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11702-1 jsoup-1.23.2-1.1 on GA media SUSE / openSUSE Security Updates · Sep 8, 2026
References
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder third-party-advisory