CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71497.json"
}

References

Affected packages

Git / github.com/jhy/jsoup

Affected ranges

Type

GIT

Repo

https://github.com/jhy/jsoup

Events

Introduced

00061629b5b91f09afbfea7eae3710bb3253c5b9

Fixed

92f1aca552548b484bc7d4b94c51e48b8e6eca70

Fixed

bb077a8b0da1203cf11d5139967f0d52fe8f5a59

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.14.3"
        },
        {
            "fixed": "1.23.1"
        }
    ]
}

Affected versions

jsoup-1.*

jsoup-1.14.3

jsoup-1.15.1

jsoup-1.15.2

jsoup-1.15.3

jsoup-1.15.4

jsoup-1.16.1

jsoup-1.16.2

jsoup-1.17.1

jsoup-1.17.2

jsoup-1.18.1

jsoup-1.18.2

jsoup-1.18.3

jsoup-1.19.1

jsoup-1.20.1

jsoup-1.21.1

jsoup-1.21.2

jsoup-1.22.1

jsoup-1.22.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71497.json"