{"id":"RHLW-2026-1af9ecf859c7dfb4","summary":"Lightwell Security Advisory: jsoup 1.17.1.rhlw-00007","details":"Red Hat Lightwell has released org.jsoup:jsoup 1.17.1.rhlw-00007 with backported fixes for CVE-2026-71497 and CVE-2026-75140.\n\nCVE-2026-71497: jsoup: Cleaner may expose markup with custom raw-text elements\n\nCVE-2026-75140: jsoup Uncontrolled Resource Consumption in XmlTreeBuilder\n\nThis patched artifact is a drop-in replacement for org.jsoup:jsoup 1.17.1 from Maven Central.","modified":"2026-11-11T20:58:10.989955419Z","published":"2026-11-11T19:24:36Z","upstream":["CVE-2026-71497","CVE-2026-75140","GHSA-65r4-943x-97jj","GHSA-pmhh-3w7g-xqp8"],"references":[{"type":"WEB","url":"https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71497.json"},{"type":"ADVISORY","url":"https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71497"},{"type":"REPORT","url":"https://github.com/jhy/jsoup/issues/2538"},{"type":"FIX","url":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pmhh-3w7g-xqp8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75140.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140"},{"type":"FIX","url":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a"},{"type":"FIX","url":"https://github.com/jhy/jsoup/pull/2556"},{"type":"PACKAGE","url":"https://github.com/jhy/jsoup"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-65r4-943x-97jj"}],"affected":[{"package":{"name":"org.jsoup:jsoup","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.jsoup/jsoup"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1.rhlw-00007"}]}],"versions":["0.2.1b","0.2.2","0.3.1","1.1.1","1.10.1","1.10.2","1.10.3","1.11.1","1.11.2","1.11.3","1.12.1","1.12.2","1.13.1","1.14.1","1.14.2","1.14.3","1.15.1","1.15.2","1.15.3","1.15.4","1.16.1","1.16.2","1.17.1","1.2.1","1.2.2","1.2.3","1.3.1","1.3.2","1.3.3","1.4.1","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3","1.7.1","1.7.2","1.7.3","1.8.1","1.8.2","1.8.3","1.9.1","1.9.2"],"database_specific":{"lightwell":{"backport_base_version":"1.17.1","remediated_version":"1.17.1.rhlw-00007","repository_url":"https://packages.redhat.com/lightwell/java/remediated/"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-1af9ecf859c7dfb4.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}