Log in Start free

Vulnerability · Published Aug 18, 2021 · Assigned by GitHub_M

CVE-2021-37714Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

High 7.5

In plain English

A high-severity infinite loop in jsoup from jhy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.7% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)6.7%top 6.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jsoup1.14.2-1DEBIAN-CVE-2021-37714
Debian:13jsoup1.14.2-1DEBIAN-CVE-2021-37714
Debian:14jsoup1.14.2-1DEBIAN-CVE-2021-37714
Mavenorg.jsoup:jsoup1.14.2GHSA-m72m-mhq2-9p6c
Ubuntu:22.04:LTSjsoupno fix listedUBUNTU-CVE-2021-37714

Affected products (as reported)

VendorProductVersions
jhy jsoup < 1.14.2

Weakness: CWE-835, CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References