CVE-2026-75140CWE-770denial-of-service

CVE-2026-75140

High · published August 20, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00525 · 43.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-20T20:18Z
References (3)
https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a · [email protected]https://github.com/jhy/jsoup/pull/2556 · [email protected]https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder · [email protected]
EPSS history
Timeline
  • 20 AUG 15:56Z
    jsoup Uncontrolled Resource Consumption in XmlTreeBuilder
    cvelistv5