CVE-2026-75140

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-75140
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75140.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-75140
Downstream
Published
2026-08-20T15:56:50.377Z
Modified
2026-08-22T09:15:59.541624Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
jsoup Uncontrolled Resource Consumption in XmlTreeBuilder
Details

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75140.json"
}
References

Affected packages

Git / github.com/jhy/jsoup

Affected ranges

Type
GIT
Repo
https://github.com/jhy/jsoup
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
862ba2f1d48ee95609183dbcfc848c9fd7afc76a
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.23.1"
        }
    ]
}

Affected versions

1.*
1.12.2
jsoup-1.*
jsoup-1.10.1
jsoup-1.10.2
jsoup-1.11.1
jsoup-1.11.2
jsoup-1.11.3
jsoup-1.12.1
jsoup-1.12.2
jsoup-1.13.1
jsoup-1.14.1
jsoup-1.14.2
jsoup-1.14.3
jsoup-1.15.1
jsoup-1.15.2
jsoup-1.15.3
jsoup-1.15.4
jsoup-1.16.1
jsoup-1.16.2
jsoup-1.17.1
jsoup-1.17.2
jsoup-1.18.1
jsoup-1.18.2
jsoup-1.18.3
jsoup-1.19.1
jsoup-1.20.1
jsoup-1.21.1
jsoup-1.21.2
jsoup-1.22.1
jsoup-1.22.2
jsoup-1.23.1
jsoup-1.6.2
jsoup-1.6.3
jsoup-1.7.1
jsoup-1.7.2
jsoup-1.7.3
jsoup-1.8.1.a
jsoup-1.8.2
jsoup-1.8.3
jsoup-1.8.3a
jsoup-1.9.1
jsoup-1.9.1a
jsoup-1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75140.json"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "208175265434316808740056386753874252581",
            "length": 435.0
        },
        "target": {
            "function": "initialiseParse",
            "file": "src/main/java/org/jsoup/parser/XmlTreeBuilder.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-1b5f0606",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "102671904027835244507929741484250350366",
            "length": 1087.0
        },
        "target": {
            "function": "elementsViaAppendHtmlAreNamespaced",
            "file": "src/test/java/org/jsoup/parser/XmlTreeBuilderTest.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-235cd0fe",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "44417621881198832653891734089081737393",
            "length": 85.0
        },
        "target": {
            "function": "pop",
            "file": "src/main/java/org/jsoup/parser/XmlTreeBuilder.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-45833a91",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "264945342622661787552218883384722326659",
            "length": 565.0
        },
        "target": {
            "function": "initialiseParseFragment",
            "file": "src/main/java/org/jsoup/parser/XmlTreeBuilder.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-6edc178c",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "102028542211179402111548145128587687712",
            "length": 477.0
        },
        "target": {
            "function": "applyNamespacesToAttributes",
            "file": "src/main/java/org/jsoup/parser/XmlTreeBuilder.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-6f7fe59a",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "328572334770534361728936320438889581864",
            "length": 358.0
        },
        "target": {
            "function": "processNamespaces",
            "file": "src/main/java/org/jsoup/parser/XmlTreeBuilder.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-7f5d7faa",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "214832587581654447851719293831566033716",
                "192981586325764109561471114941089061828",
                "67799068524554276732275332629939251747",
                "313321260752923364429531426869317433719",
                "194209531796371043750351769050676492462",
                "187265265140765547457047094039566465582",
                "333292089697159632388875763233678152436",
                "19955726647344685349188729393334580633",
                "188834543161320063579311723696295640330",
                "207849306041862184256961294357124932058",
                "205852899805047548003813237276949020072",
                "89291345605463249410466579340613529254",
                "41865347981531874729541822993019786294",
                "38385476755424256359488216893915653809",
                "289187736577680126420494667981235853897",
                "27580865396926717447114705891771541285",
                "43358783130274633955513673861878754423",
                "262564806112765962896564650443540519270",
                "204260542961645448465575439549737992731",
                "27272333377875871044394563067060088334",
                "327067051248917402906306633915867358663",
                "127009815585200543473049392706335684052",
                "130086349814368946599292077555011932167",
                "63373373207989384477840255640697181261",
                "281998304365549280931933521355368180760",
                "323692718223206778710007332043888856348"
            ]
        },
        "target": {
            "file": "src/test/java/org/jsoup/parser/XmlTreeBuilderTest.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-94435bb5",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "197511029019245579410154517052775939294",
            "length": 812.0
        },
        "target": {
            "function": "insertElementFor",
            "file": "src/main/java/org/jsoup/parser/XmlTreeBuilder.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-d0697e48",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "162481319189610433555868220634676684177",
            "length": 265.0
        },
        "target": {
            "function": "resolveNamespace",
            "file": "src/main/java/org/jsoup/parser/XmlTreeBuilder.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-ef66650e",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "171811108061124073251988269082254518962",
                "249701151165385860782687239718652701251",
                "228826812805769699550575715456433953514",
                "287750681551687029508115526637100451966",
                "81452231250075831533887575459067791830",
                "291114092585567126678186959612881728377",
                "163046865114737004050976164271092753391",
                "318434439909008215965051141812043472127",
                "183188948220994979800937321365844496065",
                "198421899648677596994880697752670907218",
                "102347949338741823322175096894646286070",
                "294648613468865335118802718111985514780",
                "291427774579270871211153495503721301697",
                "48160589425149224482801280349578506808",
                "108014861800706278290165546363729100209",
                "270783190881701448627228451449690007571",
                "334335632041790643060325161084776832684",
                "98008099053975581557416836227993269168",
                "33974151358484052902911384159520419256",
                "101241566765382006806441468631437691319",
                "67471670086682489020939136230838702372",
                "87525176315699828493519122910203521084",
                "218467109648326112023823054901958658863",
                "47742479329840815235587971477846352029",
                "294829275293590733712656403604264337778",
                "74673539849922672185044945113869787656",
                "130289817441542225739909736330273322400",
                "339091043537857616583238043603745696181",
                "113675866306746509096785681842450456858",
                "311623104420884915972053793498820356229",
                "333597579741388100845085773797796855835",
                "67141764677891504954650371623966813547",
                "302235624002816498628580276612032646421",
                "326110457711955231111257082627937870589",
                "46470953493457321092829308755393314018",
                "217537731391186814772533592388570560946",
                "293784250228803952526657698761131908165",
                "270265865661443456547927195286770265880",
                "291783352393958379493552434148940046075",
                "9463793180902175707327383275912740375",
                "194535438077762739273095473794507841571",
                "117379864506715174634038160623499208004",
                "170592290068617780420129869221354576844",
                "67792010298053587356183515478670361154",
                "206374752808261260842020951902162630938",
                "65828852176387939768774316622672542295",
                "100466638790229577128642664229852845205",
                "245253010007508824399952400058855331595",
                "319071828514490731517592235439313952175",
                "224724140652345318516909264570398147827",
                "128071127327413421230044821189588402242",
                "339060989386298468848287256977448023785",
                "182749722031393905287120990069672188688",
                "30782976692421606235747185844399172537",
                "192998934005222718873698010590940198280",
                "15042192433675969721851595983640521132",
                "118916233007887357950257233906008237108",
                "231166881259828113207865583125917782557",
                "310175471748679499406841980866917278236",
                "139091819947167197680474647463691468811",
                "93969519068432469130033446802019482819",
                "281979661434161852795705429816719875284",
                "232295716209844437584039256946192319443",
                "53883833606721275630949978833357038713",
                "326373375179619446800293225883647752531",
                "149227666436520214588014356478498586147",
                "191174611977492510753901704228398906690",
                "131149372197316628545583430674934256941",
                "166034267431524741454967950841731745382",
                "236063190051819894145702353827369316187",
                "220643058728515900671821336470928413164",
                "117692214093580777669817536818460075444",
                "144876912848871588860387138034880428564",
                "239006959209557762967532227955271484052",
                "191539801092861242866956559917773802922",
                "150203139097078174435410325383092127825",
                "23482607742014967236915570994354829409",
                "158467324702486838003792560746452608265",
                "93598440066914019056657272459122513562",
                "240921943964687784919644305964282226862",
                "237569303581834292524705017022726391334",
                "36448214758317363563803506483036757278"
            ]
        },
        "target": {
            "file": "src/main/java/org/jsoup/parser/XmlTreeBuilder.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
        "signature_version": "v1",
        "id": "CVE-2026-75140-fe1f8544",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-22T09:15:59Z"