Executive brief
jsoup is a popular Java library for parsing and manipulating HTML and XML documents. The library contained a flaw in how it processes deeply nested XML with multiple namespaces, causing it to consume excessive memory and CPU, which an attacker could exploit to crash applications that use jsoup by providing specially crafted XML files.
Technical details
The vulnerability is an uncontrolled resource consumption flaw in jsoup's XmlTreeBuilder component. The root cause is that the parser copied the entire inherited namespace map on every start element tag, resulting in quadratic time and memory complexity as nesting depth increases. An attacker can trigger this by supplying a deeply nested XML document with uniquely-namespaced elements. No authentication or user interaction is required—the malicious XML only needs to be parsed by a vulnerable jsoup instance. Successful exploitation causes an OutOfMemoryError that terminates the application, resulting in denial of service. The vulnerability was patched in commit 862ba2f (merged August 9, 2026), which optimizes namespace tracking to use a single bindings map that records only changed values per element, reducing complexity to linear.
Affected products
- jsoup jsoup through 1.23.2
Timeline
- 2026-08-20: disclosed: CVE-2026-75140 published on NVD
- 2026-08-09: patched: Fix committed in commit 862ba2f