CVE-2021-37714

NameCVE-2021-37714
Descriptionjsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs992590

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jsoup (PTS)stretch1.10.2-1vulnerable
buster, bullseye1.10.2-2vulnerable
bookworm, sid1.14.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jsoupsource(unstable)1.14.2-1992590

Notes

https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c

Search for package or bug name: Reporting problems