PT-2021-7917 · Jsoup+5 · Jsoup+5

Published 2021-08-18 · Updated 2025-11-23 · CVE-2021-37714

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions jsoup versions prior to 1.14.2

Description The issue is related to the parsing of untrusted HTML or XML, which may cause the parser to get stuck, complete more slowly than usual, or throw an unexpected exception, potentially supporting a denial of service attack. If the parser is run on user-supplied input, an attacker may supply content that exploits this issue.

Recommendations For jsoup versions prior to 1.14.2, upgrade to version 1.14.2 to resolve the issue. As a temporary workaround, consider rate limiting input parsing, limiting the size of inputs based on system resources, and/or implementing thread watchdogs to cap and timeout parse runtimes.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-248

CWE-835

Related Identifiers

ALT-PU-2025-14852

ALT-PU-2025-14912

AZL-36945

AZL-7253

BDU:2023-05361

CVE-2021-37714

GHSA-M72M-MHQ2-9P6C

OESA-2021-1335

OPENSUSE-SU-2022_1265-1

OPENSUSE-SU-2024:10882-1

OPENSUSE-SU-2024:10883-1

RHSA-2021:4676

RHSA-2021:4677

RHSA-2021:5149

RHSA-2021:5150

RHSA-2021:5151

RHSA-2025:4226

SUSE-SU-2022:1265-1

SUSE-SU-2022_1265-1

Affected Products

Alt Linux

Astra Linux

Debian

Jira

Suse

Jsoup

References · 49

• https://nvd.nist.gov/vuln/detail/CVE-2021-37714 · Security Note
• https://jsoup.org/news/release-1.14.2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37714 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://osv.dev/vulnerability/SUSE-SU-2022:1265-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://bdu.fstec.ru/vul/2023-05361 · Security Note
• https://osv.dev/vulnerability/GHSA-m72m-mhq2-9p6c · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-37714 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10883-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10882-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/701807 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://jsoup.org/news/release-1.14.1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-37714 · Vendor Advisory