CVE-2021-37714
published 2021-08-18CVE-2021-37714: jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
6.69%
93.9th percentile
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | jira_software | — | — |
| debian | jsoup | < jsoup 1.14.2-1 (bookworm) | jsoup 1.14.2-1 (bookworm) |
| jhy | jsoup | < 1.14.2 | 1.14.2 |
| jsoup | jsoup | < 1.14.2 | 1.14.2 |
| jsoup | jsoup | >= 0 < 1.14.2-1 | 1.14.2-1 |
| jsoup | jsoup | >= 0 < 1.14.2-1 | 1.14.2-1 |
| jsoup | jsoup | >= 0 < 1.14.2-1 | 1.14.2-1 |
| msrc | cbl2_jsoup_on_cbl_mariner_2.0 | — | — |
| oracle | banking_trade_finance | — | — |
| oracle | banking_treasury_management | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | communications_messaging_server | — | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | flexcube_universal_banking | — | — |
| oracle | flexcube_universal_banking | 14.0.0 – 14.3.0 | — |
| oracle | hospitality_token_proxy_service | — | — |
| oracle | middleware_common_libraries_and_tools | — | — |
| oracle | middleware_common_libraries_and_tools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | retail_customer_management_and_segmentation_foundation | 17.0 – 19.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Atlassian
CVE-2021-37714: DoS (Denial of Service) org.jsoup:jsoup in Jira Software Data Center and Server
vendor_atlassian·2023-11-21·CVSS 7.5
CVE-2021-37714 [HIGH] CVE-2021-37714: DoS (Denial of Service) org.jsoup:jsoup in Jira Software Data Center and Server
CVE-2021-37714: DoS (Denial of Service) org.jsoup:jsoup in Jira Software Data Center and Server
DoS (Denial of Service) org.jsoup:jsoup in Jira Software Data Center and Server
CVE: CVE-2021-37714
Severity: HIGH
Affected products: Jira Software
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Portal Core (jsoup) — CVE-2021-37714
vendor_oracle·2023-10-15·CVSS 7.5
CVE-2021-37714 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Portal Core (jsoup) — CVE-2021-37714
Oracle Oracle Fusion Middleware Risk Matrix: Portal Core (jsoup) vulnerability
CVE: CVE-2021-37714
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle GoldenGate Risk Matrix: Oracle Stream Analytics (jsoup) — CVE-2021-37714
vendor_oracle·2022-07-15·CVSS 4.9
CVE-2021-37714 [HIGH] Oracle Oracle GoldenGate Risk Matrix: Oracle Stream Analytics (jsoup) — CVE-2021-37714
Oracle Oracle GoldenGate Risk Matrix: Oracle Stream Analytics (jsoup) vulnerability
CVE: CVE-2021-37714
CVSS: 4.9
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (jsoup) — CVE-2021-37714
vendor_oracle·2022-04-15·CVSS 7.5
CVE-2021-37714 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (jsoup) — CVE-2021-37714
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (jsoup) vulnerability
CVE: CVE-2021-37714
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: ISC (jsoup) — CVE-2021-37714
vendor_oracle·2022-01-15·CVSS 7.5
CVE-2021-37714 [HIGH] Oracle Oracle Communications Applications Risk Matrix: ISC (jsoup) — CVE-2021-37714
Oracle Oracle Communications Applications Risk Matrix: ISC (jsoup) vulnerability
CVE: CVE-2021-37714
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Red Hat
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
vendor_redhat·2021-08-18·CVSS 7.5
CVE-2021-37714 [HIGH] CWE-400 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
Package: jsoup (Red Hat BPM Suite 6) - Out of support scope
Microsoft
Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions
vendor_msrc·2021-08-10·CVSS 7.5
CVE-2021-37714 [HIGH] CWE-835 Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions
Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Re
Debian
CVE-2021-37714: jsoup - jsoup is a Java library for working with HTML. Those using jsoup versions prior ...
vendor_debian·2021·CVSS 7.5
CVE-2021-37714 [HIGH] CVE-2021-37714: jsoup - jsoup is a Java library for working with HTML. Those using jsoup versions prior ...
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
Scope: local
bookworm: resolved (fixed in 1.14.2-1)
bullseye: open
forky: resolved (fixed in 1.14.2-1)
sid: resolved (fixed in 1.14.2-1
GHSA
Uncaught Exception in jsoup
ghsa·2021-08-23
CVE-2021-37714 [HIGH] CWE-248 Uncaught Exception in jsoup
Uncaught Exception in jsoup
### Impact
_What kind of vulnerability is it? Who is impacted?_
Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to jsoup 1.14.2
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Users may rate limit input parsing. Users should limit the size of inputs based on system resources. Users should implement thre
OSV
Uncaught Exception in jsoup
osv·2021-08-23
CVE-2021-37714 [HIGH] Uncaught Exception in jsoup
Uncaught Exception in jsoup
### Impact
_What kind of vulnerability is it? Who is impacted?_
Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to jsoup 1.14.2
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Users may rate limit input parsing. Users should limit the size of inputs based on system resources. Users should implement thre
OSV
CVE-2021-37714: jsoup is a Java library for working with HTML
osv·2021-08-18·CVSS 7.5
CVE-2021-37714 [HIGH] CVE-2021-37714: jsoup is a Java library for working with HTML
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
No detection rules found.
No public exploits indexed.
https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6chttps://jsoup.org/news/release-1.14.1https://jsoup.org/news/release-1.14.2https://lists.apache.org/thread.html/r215009dbf7467a9f6506d0c0024cb36cad30071010e62c9352cfaaf0%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/r377b93d79817ce649e9e68b3456e6f499747ef1643fa987b342e082e%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/r3d71f18adb78e50f626dde689161ca63d3b7491bd9718fcddfaecba7%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/r50e9c9466c592ca9d707a5dea549524d19e3287da08d8392f643960e%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/r685c5235235ad0c26e86d0ee987fb802c9675de6081dbf0516464e0b%40%3Cnotifications.james.apache.org%3Ehttps://lists.apache.org/thread.html/r97404676a5cf591988faedb887d64e278f522adcaa823d89ca69defe%40%3Cnotifications.james.apache.org%3Ehttps://lists.apache.org/thread.html/rc3354080fc67fb50b45b3c2d12dc4ca2a3c1c78dad3d3ba012c038aa%40%3Cnotifications.james.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20220210-0022/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6chttps://jsoup.org/news/release-1.14.1https://jsoup.org/news/release-1.14.2https://lists.apache.org/thread.html/r215009dbf7467a9f6506d0c0024cb36cad30071010e62c9352cfaaf0%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/r377b93d79817ce649e9e68b3456e6f499747ef1643fa987b342e082e%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/r3d71f18adb78e50f626dde689161ca63d3b7491bd9718fcddfaecba7%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/r50e9c9466c592ca9d707a5dea549524d19e3287da08d8392f643960e%40%3Cissues.maven.apache.org%3Ehttps://lists.apache.org/thread.html/r685c5235235ad0c26e86d0ee987fb802c9675de6081dbf0516464e0b%40%3Cnotifications.james.apache.org%3Ehttps://lists.apache.org/thread.html/r97404676a5cf591988faedb887d64e278f522adcaa823d89ca69defe%40%3Cnotifications.james.apache.org%3Ehttps://lists.apache.org/thread.html/rc3354080fc67fb50b45b3c2d12dc4ca2a3c1c78dad3d3ba012c038aa%40%3Cnotifications.james.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20220210-0022/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2021-08-18
Published