Sulkta-OSS/straw
3
0
Fork 0
Code Issues 1 Pull requests 12 Projects Releases Packages Wiki Activity Actions

Update dependency org.jsoup:jsoup to v1.23.2 [SECURITY] #29

Open
renovate wants to merge 1 commit from renovate/jsoup into main
pull from: renovate/jsoup
merge into: Sulkta-OSS:main
Conversation 0 Commits 1 Files changed 1 +1 -1
renovate commented 2026-08-07 00:05:40 -07:00
Member
Copy link

This PR contains the following updates:

Package Type Update Change
org.jsoup:jsoup (source) dependencies minor 1.22.2 → 1.23.2

jsoup: Cleaner may expose markup with custom raw-text elements

CVE-2026-71497 / GHSA-pmhh-3w7g-xqp8

More information

Details

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.

jsoup’s built-in Safelists are unaffected.

Patches

Upgrade to jsoup 1.23.1.

Workarounds

Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.

Additional security considerations

This fix addresses malformed tag-name handling only.

Permitting raw-text elements in a custom Safelist does not make their contents inherently safe. For example, applications that permit style must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS.

Severity

  • CVSS Score: 4.7 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations

CVE-2026-75140 / GHSA-65r4-943x-97jj

More information

Details

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [org.jsoup:jsoup](https://jsoup.org/) ([source](https://github.com/jhy/jsoup)) | dependencies | minor | `1.22.2` → `1.23.2` | --- ### jsoup: Cleaner may expose markup with custom raw-text elements [CVE-2026-71497](https://nvd.nist.gov/vuln/detail/CVE-2026-71497) / [GHSA-pmhh-3w7g-xqp8](https://github.com/advisories/GHSA-pmhh-3w7g-xqp8) <details> <summary>More information</summary> #### Details When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS. jsoup’s built-in Safelists are unaffected. ##### Patches Upgrade to jsoup 1.23.1. ##### Workarounds Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML. ##### Additional security considerations This fix addresses malformed tag-name handling only. Permitting raw-text elements in a custom `Safelist` does not make their contents inherently safe. For example, applications that permit `style` must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS. #### Severity - CVSS Score: 4.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N` #### References - [https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8](https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8) - [https://github.com/jhy/jsoup/issues/2538](https://github.com/jhy/jsoup/issues/2538) - [https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70](https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70) - [https://github.com/jhy/jsoup](https://github.com/jhy/jsoup) - [https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1](https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-pmhh-3w7g-xqp8) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations [CVE-2026-75140](https://nvd.nist.gov/vuln/detail/CVE-2026-75140) / [GHSA-65r4-943x-97jj](https://github.com/advisories/GHSA-65r4-943x-97jj) <details> <summary>More information</summary> #### Details jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application. #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-75140](https://nvd.nist.gov/vuln/detail/CVE-2026-75140) - [https://github.com/jhy/jsoup/pull/2556](https://github.com/jhy/jsoup/pull/2556) - [https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a](https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a) - [https://github.com/jhy/jsoup](https://github.com/jhy/jsoup) - [https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2](https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2) - [https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder](https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-65r4-943x-97jj) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTMuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI1My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
renovate added 1 commit 2026-08-07 00:05:42 -07:00
renovate changed title from chore(deps): update dependency org.jsoup:jsoup to v1.23.1 [security] to chore(deps): update dependency org.jsoup:jsoup to v1.23.2 [security] 2026-10-05 23:18:44 -07:00
renovate force-pushed renovate/jsoup from aafaa71923 to 19ca352760 2026-10-05 23:18:45 -07:00 Compare
renovate changed title from chore(deps): update dependency org.jsoup:jsoup to v1.23.2 [security] to Update dependency org.jsoup:jsoup to v1.23.2 [SECURITY] 2026-10-24 23:16:44 -07:00
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/jsoup:renovate/jsoup
git checkout renovate/jsoup
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Sulkta-OSS/straw#29
No description provided.
Delete branch "renovate/jsoup"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?