CVE-2026-75140: jsoup XML namespace handling denial of service

CVE-2026-75140 · Severity: high · CVSS 7.5 · Published 2026-08-20

jsoup is a popular Java library for parsing and manipulating HTML and XML documents. The library contained a flaw in how it processes deeply nested XML with multiple namespaces, causing it to consume excessive memory and CPU, which an attacker could exploit to crash applications that use jsoup by providing specially crafted XML files.

Technologies: org.jsoup:jsoup (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-75140 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75140 being exploited in the wild.
How severe is CVE-2026-75140?
High severity, with a CVSS score of 7.5, published 20 August 2026.
Which products and versions are affected?
Jsoup through 1.23.2; org.jsoup:jsoup (Maven) < 1.23.2, ECOSYSTEM:introduced=0,fixed=1.23.2.
Is there a fix for CVE-2026-75140?
Yes. org.jsoup:jsoup (Maven): upgrade to 1.23.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75140 attacked?
It is attacked over the network.
Am I affected by CVE-2026-75140?
Check whether you run Jsoup or org.jsoup:jsoup (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jsoup:jsoup (Maven): upgrade to 1.23.2 or later
    # set org.jsoup:jsoup to 1.23.2 in your pom.xml or build.gradle

Technical details

The vulnerability is an uncontrolled resource consumption flaw in jsoup's XmlTreeBuilder component. The root cause is that the parser copied the entire inherited namespace map on every start element tag, resulting in quadratic time and memory complexity as nesting depth increases. An attacker can trigger this by supplying a deeply nested XML document with uniquely-namespaced elements. No authentication or user interaction is required—the malicious XML only needs to be parsed by a vulnerable jsoup instance. Successful exploitation causes an OutOfMemoryError that terminates the application, resulting in denial of service. The vulnerability was patched in commit 862ba2f (merged August 9, 2026), which optimizes namespace tracking to use a single bindings map that records only changed values per element, reducing complexity to linear.

Affected products

  • jsoup jsoup through 1.23.2

Identifiers

  • CVE-2026-75140
  • GHSA-65r4-943x-97jj

Timeline

  • 2026-08-20: disclosed: CVE-2026-75140 published on NVD
  • 2026-08-09: patched: Fix committed in commit 862ba2f

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.