---
id: CVE-2026-71497
title: jsoup is a Java library for working with real-world HTML
summary: >-
  jsoup is a Java library for working with real-world HTML. From 1.14.3 until
  1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name
  ending in a control character, causing the tag to acquire the parsing behavior
  of a dif…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
  - CWE-1289
vendor: jsoup
product: 'org.jsoup:jsoup'
affected:
  - 'org.jsoup:jsoup >= 1.14.3, < 1.23.1'
patched:
  - 'org.jsoup:jsoup 1.23.1'
published: '2026-08-06'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:41:33.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71497'
references:
  - url: >-
      https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70
    label: security-advisories@github.com
  - url: 'https://github.com/jhy/jsoup/issues/2538'
    label: security-advisories@github.com
  - url: 'https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1'
    label: security-advisories@github.com
  - url: 'https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-pmhh-3w7g-xqp8'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71497.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71497'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512346'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71497'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71497'
tags:
  - nvd
  - ghsa
  - maven
  - csaf
  - vex
  - red-hat
epss: 0.0019
epssPercentile: 0.0897
aliases:
  - GHSA-pmhh-3w7g-xqp8
ecosystem: maven
ingestedAt: '2026-08-06T22:05:23.338Z'
---

## Overview

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71497)

Affected packages:

- `org.jsoup:jsoup >= 1.14.3, < 1.23.1`

Patched in:

- `org.jsoup:jsoup 1.23.1`

Source: https://github.com/advisories/GHSA-pmhh-3w7g-xqp8

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Cryostat 4, Migration Toolkit for Applications 8, OpenShift Developer Tools and Services, Red Hat AMQ Broker 7, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 3, … · no fix planned: Cryostat 4, Migration Toolkit for Applications 8, OpenShift Developer Tools and Services, Red Hat AMQ Broker 7, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71497.json)