{"id":"RHLW-2026-dc6bb5cbbfc647ed","summary":"Lightwell Security Advisory: jsoup 1.22.1.rhlw-00002","details":"Red Hat Lightwell has released org.jsoup:jsoup 1.22.1.rhlw-00002 with backported fixes for CVE-2026-71497 and CVE-2026-75140.\n\nCVE-2026-71497: jsoup: Cleaner may expose markup with custom raw-text elements\n\nCVE-2026-75140: jsoup Uncontrolled Resource Consumption in XmlTreeBuilder\n\nThis patched artifact is a drop-in replacement for org.jsoup:jsoup 1.22.1 from Maven Central.","modified":"2026-11-06T19:43:10.817049240Z","published":"2026-11-04T00:13:08Z","upstream":["CVE-2026-71497","CVE-2026-75140","GHSA-65r4-943x-97jj","GHSA-pmhh-3w7g-xqp8"],"references":[{"type":"WEB","url":"https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71497.json"},{"type":"ADVISORY","url":"https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71497"},{"type":"REPORT","url":"https://github.com/jhy/jsoup/issues/2538"},{"type":"FIX","url":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pmhh-3w7g-xqp8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75140.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140"},{"type":"REPORT","url":"https://github.com/jhy/jsoup/pull/2556"},{"type":"FIX","url":"https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a"},{"type":"PACKAGE","url":"https://github.com/jhy/jsoup"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-65r4-943x-97jj"}],"affected":[{"package":{"name":"org.jsoup:jsoup","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.jsoup/jsoup"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1.rhlw-00002"}]}],"versions":["0.2.1b","0.2.2","0.3.1","1.1.1","1.10.1","1.10.2","1.10.3","1.11.1","1.11.2","1.11.3","1.12.1","1.12.2","1.13.1","1.14.1","1.14.2","1.14.3","1.15.1","1.15.2","1.15.3","1.15.4","1.16.1","1.16.2","1.17.1","1.17.2","1.18.1","1.18.2","1.18.3","1.19.1","1.2.1","1.2.2","1.2.3","1.20.1","1.21.1","1.21.2","1.22.1","1.3.1","1.3.2","1.3.3","1.4.1","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3","1.7.1","1.7.2","1.7.3","1.8.1","1.8.2","1.8.3","1.9.1","1.9.2"],"database_specific":{"lightwell":{"remediated_version":"1.22.1.rhlw-00002","repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"1.22.1"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-dc6bb5cbbfc647ed.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}