CVE-2026-71497

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71497
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-71497.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-71497
Aliases
Downstream
Published
2026-08-06T21:09:31.489Z
Modified
2026-08-12T15:42:48.079682Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
jsoup: Cleaner may expose markup with custom raw-text elements
Details

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71497.json",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/jhy/jsoup

Affected ranges

Type
GIT
Repo
https://github.com/jhy/jsoup
Events
Introduced
00061629b5b91f09afbfea7eae3710bb3253c5b9
Fixed
92f1aca552548b484bc7d4b94c51e48b8e6eca70
Fixed
bb077a8b0da1203cf11d5139967f0d52fe8f5a59
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.14.3"
        },
        {
            "fixed": "1.23.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

jsoup-1.*
jsoup-1.14.3
jsoup-1.15.1
jsoup-1.15.2
jsoup-1.15.3
jsoup-1.15.4
jsoup-1.16.1
jsoup-1.16.2
jsoup-1.17.1
jsoup-1.17.2
jsoup-1.18.1
jsoup-1.18.2
jsoup-1.18.3
jsoup-1.19.1
jsoup-1.20.1
jsoup-1.21.1
jsoup-1.21.2
jsoup-1.22.1
jsoup-1.22.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-71497.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "181937326342852076969631988948472760966",
                "153759009126021349332686888965552578759",
                "110103009878483414043234074826686750999",
                "280983565190875460999991314424467850322",
                "44879387428943934398063494593555988781",
                "281013167577187782941348744601305113415",
                "132651764799526623173506411791279872674",
                "118801729594699250346882549224222220386"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2026-71497-02baaf11",
        "target": {
            "file": "src/test/java/org/jsoup/parser/HtmlParserTest.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "157600237706555189700778834611797555669",
            "length": 171.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-71497-17c24fb8",
        "target": {
            "file": "src/main/java/org/jsoup/parser/Token.java",
            "function": "nameAttr"
        },
        "source": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "42768351644726929465130838818785995138",
            "length": 670.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-71497-330e2957",
        "target": {
            "file": "src/main/java/org/jsoup/parser/TagSet.java",
            "function": "valueOf"
        },
        "source": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "99205503112061543274572075647532678468",
            "length": 229.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-71497-406aaee9",
        "target": {
            "file": "src/main/java/org/jsoup/parser/Token.java",
            "function": "appendTagName"
        },
        "source": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "320346690699526294315085580175792088986",
            "length": 141.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-71497-4acb22d2",
        "target": {
            "file": "src/main/java/org/jsoup/parser/Token.java",
            "function": "name"
        },
        "source": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "114506412939303152943025189246662976791",
                "6468248189561806296306208327357264893",
                "212483296159735211704915955923332469908",
                "166031996771800364001160511635887560197",
                "307895170492363027608201065183334499350",
                "170722787310263641587941796978902641014",
                "65825153413339884381956325733625700351",
                "117250129441957657566612654968240729890",
                "76610147440603746967711415791025298649",
                "70306176552762831276031226579322779318",
                "330843490298097763512895131146049888033",
                "9994816610627898568336697686211625063",
                "12882196562779033412965184643645673214",
                "339063576627228652424626037814535341877",
                "269717461413623348418939782708611252891"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2026-71497-568c4699",
        "target": {
            "file": "src/main/java/org/jsoup/parser/Token.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "247966881702737650215080544208975685021",
                "286871881968807575649285402629406307476",
                "285228090814398608008872802180812570997",
                "173609387921123636447835373953798411602"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2026-71497-b6487cec",
        "target": {
            "file": "src/main/java/org/jsoup/parser/TagSet.java"
        },
        "source": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "113575858987951919013459713086601574071",
            "length": 233.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-71497-f754b815",
        "target": {
            "file": "src/test/java/org/jsoup/parser/HtmlParserTest.java",
            "function": "trimNormalizeElementNamesInBuilder"
        },
        "source": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
    }
]
vanir_signatures_modified 
"2026-08-12T15:42:48Z"