Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-06T21:09:31 org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CWE-1289

A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup after serialization. This could allow a remote attacker to achieve cross-site scripting (XSS).

This cross-site scripting flaw in jsoup requires a custom `Safelist` that explicitly allows raw-text elements, which is not a default configuration. Exploitation is limited to applications processing untrusted HTML with such a permissive custom `Safelist`, reducing the overall risk. Cryostat 4 Fix deferred jsoup Migration Toolkit for Applications 8 Fix deferred mta/mta-cli-rhel9 Migration Toolkit for Applications 8 Fix deferred mta/mta-java-external-provider-rhel9 OpenShift Developer Tools and Services Fix deferred jenkins-2-plugins OpenShift Developer Tools and Services Fix deferred ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Fix deferred ocp-tools-4/jenkins-rhel9 Red Hat AMQ Broker 7 Fix deferred jsoup Red Hat build of Apache Camel - HawtIO 4 Fix deferred jsoup Red Hat build of Apicurio Registry 3 Fix deferred jsoup Red Hat build of Quarkus Fix deferred jsoup Red Hat build of Quarkus Native builder Fix deferred jsoup Red Hat Enterprise Linux 10 Fix deferred jakarta-mail Red Hat Enterprise Linux 7 Fix deferred maven-wagon Red Hat Enterprise Linux 8 Fix deferred javapackages-tools:201801/maven-wagon Red Hat Enterprise Linux 9 Fix deferred jakarta-mail Red Hat Enterprise Linux 9 Fix deferred jmc Red Hat Enterprise Linux 9 Fix deferred maven Red Hat Enterprise Linux 9 Fix deferred maven-wagon Red Hat JBoss Enterprise Application Platform 7 Fix deferred eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred jboss-eap-7-eap74-els-openjdk11-openshift-rhel8/jboss-eap-7-eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred jsoup Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred jsoup Red Hat Single Sign-On 7 Fix deferred jsoup streams for Apache Kafka 2 Fix deferred jsoup streams for Apache Kafka 3 Fix deferred jsoup https://www.cve.org/CVERecord?id=CVE-2026-71497 https://nvd.nist.gov/vuln/detail/CVE-2026-71497 https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70 https://github.com/jhy/jsoup/issues/2538 https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1 https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8