{"id":"CVE-2026-75140","summary":"jsoup Uncontrolled Resource Consumption in XmlTreeBuilder","details":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.","modified":"2026-08-22T09:15:59.541624Z","published":"2026-08-20T15:56:50.377Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75140.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75140.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"},{"type":"REPORT","url":"https://github.com/jhy/jsoup/pull/2556"},{"type":"FIX","url":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a"},{"type":"PACKAGE","url":"https://github.com/jhy/jsoup"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jhy/jsoup","events":[{"introduced":"0"},{"fixed":"862ba2f1d48ee95609183dbcfc848c9fd7afc76a"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.23.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["jsoup-1.23.1","jsoup-1.22.2","jsoup-1.22.1","jsoup-1.21.2","jsoup-1.21.1","jsoup-1.20.1","jsoup-1.19.1","jsoup-1.18.3","jsoup-1.18.2","jsoup-1.18.1","jsoup-1.17.2","jsoup-1.17.1","jsoup-1.16.2","jsoup-1.16.1","jsoup-1.15.4","jsoup-1.15.3","jsoup-1.15.2","jsoup-1.15.1","jsoup-1.14.3","jsoup-1.14.2","jsoup-1.14.1","jsoup-1.13.1","jsoup-1.12.2","1.12.2","jsoup-1.12.1","jsoup-1.11.3","jsoup-1.11.2","jsoup-1.11.1","jsoup-1.10.2","jsoup-1.10.1","jsoup-1.9.2","jsoup-1.9.1a","jsoup-1.9.1","jsoup-1.8.3a","jsoup-1.8.3","jsoup-1.8.2","jsoup-1.8.1.a","jsoup-1.7.3","jsoup-1.7.2","jsoup-1.7.1","jsoup-1.6.3","jsoup-1.6.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75140.json","vanir_signatures_modified":"2026-08-22T09:15:59Z","vanir_signatures":[{"deprecated":false,"digest":{"length":435,"function_hash":"208175265434316808740056386753874252581"},"id":"CVE-2026-75140-1b5f0606","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/main/java/org/jsoup/parser/XmlTreeBuilder.java","function":"initialiseParse"}},{"source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/test/java/org/jsoup/parser/XmlTreeBuilderTest.java","function":"elementsViaAppendHtmlAreNamespaced"},"deprecated":false,"digest":{"function_hash":"102671904027835244507929741484250350366","length":1087},"id":"CVE-2026-75140-235cd0fe","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"44417621881198832653891734089081737393","length":85},"id":"CVE-2026-75140-45833a91","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/main/java/org/jsoup/parser/XmlTreeBuilder.java","function":"pop"}},{"deprecated":false,"digest":{"function_hash":"264945342622661787552218883384722326659","length":565},"id":"CVE-2026-75140-6edc178c","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/main/java/org/jsoup/parser/XmlTreeBuilder.java","function":"initialiseParseFragment"}},{"digest":{"function_hash":"102028542211179402111548145128587687712","length":477},"id":"CVE-2026-75140-6f7fe59a","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/main/java/org/jsoup/parser/XmlTreeBuilder.java","function":"applyNamespacesToAttributes"},"deprecated":false},{"id":"CVE-2026-75140-7f5d7faa","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/main/java/org/jsoup/parser/XmlTreeBuilder.java","function":"processNamespaces"},"deprecated":false,"digest":{"length":358,"function_hash":"328572334770534361728936320438889581864"}},{"target":{"file":"src/test/java/org/jsoup/parser/XmlTreeBuilderTest.java"},"deprecated":false,"digest":{"line_hashes":["214832587581654447851719293831566033716","192981586325764109561471114941089061828","67799068524554276732275332629939251747","313321260752923364429531426869317433719","194209531796371043750351769050676492462","187265265140765547457047094039566465582","333292089697159632388875763233678152436","19955726647344685349188729393334580633","188834543161320063579311723696295640330","207849306041862184256961294357124932058","205852899805047548003813237276949020072","89291345605463249410466579340613529254","41865347981531874729541822993019786294","38385476755424256359488216893915653809","289187736577680126420494667981235853897","27580865396926717447114705891771541285","43358783130274633955513673861878754423","262564806112765962896564650443540519270","204260542961645448465575439549737992731","27272333377875871044394563067060088334","327067051248917402906306633915867358663","127009815585200543473049392706335684052","130086349814368946599292077555011932167","63373373207989384477840255640697181261","281998304365549280931933521355368180760","323692718223206778710007332043888856348"],"threshold":0.9},"id":"CVE-2026-75140-94435bb5","signature_type":"Line","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a"},{"deprecated":false,"digest":{"function_hash":"197511029019245579410154517052775939294","length":812},"id":"CVE-2026-75140-d0697e48","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/main/java/org/jsoup/parser/XmlTreeBuilder.java","function":"insertElementFor"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/main/java/org/jsoup/parser/XmlTreeBuilder.java","function":"resolveNamespace"},"deprecated":false,"digest":{"function_hash":"162481319189610433555868220634676684177","length":265},"id":"CVE-2026-75140-ef66650e"},{"id":"CVE-2026-75140-fe1f8544","signature_type":"Line","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","target":{"file":"src/main/java/org/jsoup/parser/XmlTreeBuilder.java"},"deprecated":false,"digest":{"line_hashes":["171811108061124073251988269082254518962","249701151165385860782687239718652701251","228826812805769699550575715456433953514","287750681551687029508115526637100451966","81452231250075831533887575459067791830","291114092585567126678186959612881728377","163046865114737004050976164271092753391","318434439909008215965051141812043472127","183188948220994979800937321365844496065","198421899648677596994880697752670907218","102347949338741823322175096894646286070","294648613468865335118802718111985514780","291427774579270871211153495503721301697","48160589425149224482801280349578506808","108014861800706278290165546363729100209","270783190881701448627228451449690007571","334335632041790643060325161084776832684","98008099053975581557416836227993269168","33974151358484052902911384159520419256","101241566765382006806441468631437691319","67471670086682489020939136230838702372","87525176315699828493519122910203521084","218467109648326112023823054901958658863","47742479329840815235587971477846352029","294829275293590733712656403604264337778","74673539849922672185044945113869787656","130289817441542225739909736330273322400","339091043537857616583238043603745696181","113675866306746509096785681842450456858","311623104420884915972053793498820356229","333597579741388100845085773797796855835","67141764677891504954650371623966813547","302235624002816498628580276612032646421","326110457711955231111257082627937870589","46470953493457321092829308755393314018","217537731391186814772533592388570560946","293784250228803952526657698761131908165","270265865661443456547927195286770265880","291783352393958379493552434148940046075","9463793180902175707327383275912740375","194535438077762739273095473794507841571","117379864506715174634038160623499208004","170592290068617780420129869221354576844","67792010298053587356183515478670361154","206374752808261260842020951902162630938","65828852176387939768774316622672542295","100466638790229577128642664229852845205","245253010007508824399952400058855331595","319071828514490731517592235439313952175","224724140652345318516909264570398147827","128071127327413421230044821189588402242","339060989386298468848287256977448023785","182749722031393905287120990069672188688","30782976692421606235747185844399172537","192998934005222718873698010590940198280","15042192433675969721851595983640521132","118916233007887357950257233906008237108","231166881259828113207865583125917782557","310175471748679499406841980866917278236","139091819947167197680474647463691468811","93969519068432469130033446802019482819","281979661434161852795705429816719875284","232295716209844437584039256946192319443","53883833606721275630949978833357038713","326373375179619446800293225883647752531","149227666436520214588014356478498586147","191174611977492510753901704228398906690","131149372197316628545583430674934256941","166034267431524741454967950841731745382","236063190051819894145702353827369316187","220643058728515900671821336470928413164","117692214093580777669817536818460075444","144876912848871588860387138034880428564","239006959209557762967532227955271484052","191539801092861242866956559917773802922","150203139097078174435410325383092127825","23482607742014967236915570994354829409","158467324702486838003792560746452608265","93598440066914019056657272459122513562","240921943964687784919644305964282226862","237569303581834292524705017022726391334","36448214758317363563803506483036757278"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}