CVE-2026-71497
published 2026-08-06CVE-2026-71497: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in…
PriorityP423medium4.7CVSS 3.1
AVNACHPRNUIRSCCLILAN
EPSS
0.30%
21.1th percentile
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| eap74-els-openjdk11-openshift-rhel8 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| eap74-els-openjdk17-openshift-rhel8 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| eap74-els-openjdk8-openshift-rhel8 | eap74-els-openjdk8-openshift-rhel8 | — | — |
| javapackages-tools_201801 | maven-wagon | — | — |
| jboss-eap-7-eap74-els-openjdk11-openshift-rhel8 | jboss-eap-7-eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7-eap74-els-openjdk17-openshift-rhel8 | jboss-eap-7-eap74-els-openjdk17-openshift-rhel8 | — | — |
| jhy | jsoup | — | — |
| jsoup | jsoup | — | — |
| mta | mta-cli-rhel9 | — | — |
| mta | mta-java-external-provider-rhel9 | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
jhy jsoup up to 1.23.0 HTML Parser HTML injection
vuldb·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] jhy jsoup up to 1.23.0 HTML Parser HTML injection
A vulnerability was found in jhy jsoup up to 1.23.0. It has been declared as problematic. The impacted element is an unknown function of the component HTML Parser. The manipulation results in HTML injection.
This vulnerability is known as CVE-2026-71497. It is possible to launch the attack remotely. No exploit is available.
It is recommended to upgrade the affected component.
GHSA
jsoup: Cleaner may expose markup with custom raw-text elements
ghsa·2026-08-06
CVE-2026-71497 [MEDIUM] CWE-79 jsoup: Cleaner may expose markup with custom raw-text elements
jsoup: Cleaner may expose markup with custom raw-text elements
When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.
jsoup’s built-in Safelists are unaffected.
## Patches
Upgrade to jsoup 1.23.1.
## Workarounds
Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.
## Additional security considerations
This fix addresses malformed tag-name handling only.
Permitting raw-text elements in a custom `Safelist` does not make their contents inherently safe
Red Hat
org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
vendor_redhat·2026-08-06·CVSS 4.7
CVE-2026-71497 [MEDIUM] CWE-1289 org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup after serialization. This could allow a remote attacker to achieve cross-site scripting (XSS).
Statement: This cross-site scripting flaw in jsoup requires a custom `Safelist` that explicitly allows raw-text elements, which is not a default configuration. Exploitation is limited to applications processing untrusted HTML with such a permissive custom `Safelist`, reducing the overall risk.
Package: jsoup (Cryostat 4) - Fix de
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71497 jakarta-mail1: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
bugzilla·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 jakarta-mail1: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
CVE-2026-71497 jakarta-mail1: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting.
Bugzilla
CVE-2026-71497 calligraplan: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
bugzilla·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 calligraplan: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
CVE-2026-71497 calligraplan: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. j
Bugzilla
CVE-2026-71497 flexmark-java: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
bugzilla·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 flexmark-java: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
CVE-2026-71497 flexmark-java: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting.
Bugzilla
CVE-2026-71497 cldr-emoji-annotation: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
bugzilla·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 cldr-emoji-annotation: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
CVE-2026-71497 cldr-emoji-annotation: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scr
Bugzilla
CVE-2026-71497 jakarta-mail: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
bugzilla·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 jakarta-mail: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
CVE-2026-71497 jakarta-mail: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. j
Bugzilla
CVE-2026-71497 byte-buddy: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
bugzilla·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 byte-buddy: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
CVE-2026-71497 byte-buddy: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jso
Bugzilla
CVE-2026-71497 maven-doxia: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
bugzilla·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 maven-doxia: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
CVE-2026-71497 maven-doxia: jsoup: Cross-site scripting via malformed HTML tag names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. js
Bugzilla
CVE-2026-71497 jakarta-mail1: jsoup: Cross-site scripting via malformed HTML tag names [epel-all]
bugzilla·2026-08-07·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 jakarta-mail1: jsoup: Cross-site scripting via malformed HTML tag names [epel-all]
CVE-2026-71497 jakarta-mail1: jsoup: Cross-site scripting via malformed HTML tag names [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. js
Bugzilla
CVE-2026-71497 org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
bugzilla·2026-08-06·CVSS 4.7
CVE-2026-71497 [MEDIUM] CVE-2026-71497 org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
CVE-2026-71497 org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.
2026-08-06
Published