Uncontrolled Resource Consumption Vulnerability in jsoup by jhy

CVE-2026-75140

What is CVE-2026-75140?

The jsoup library, through version 1.23.2, is susceptible to an uncontrolled resource consumption vulnerability in its XmlTreeBuilder component. This issue allows remote attackers to exhaust JVM heap memory by providing a deeply nested XML document with uniquely-namespaced elements. The builder unnecessarily copies the entire inherited namespace map for each start element, resulting in significant resource usage and leading to quadratic time and memory complexity. Attackers can exploit this vulnerability to trigger an OutOfMemoryError, ultimately causing the application to terminate.

References