RHLW-2026-eaa1bbe31b9d0cc3

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-eaa1bbe31b9d0cc3.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-eaa1bbe31b9d0cc3.json
JSON Data
https://api.test.osv.dev/v1/vulns/RHLW-2026-eaa1bbe31b9d0cc3
Upstream
CVE (2)
GHSA (2)
Published
2026-09-17T21:37:40Z
Modified
2026-10-22T00:08:25Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Lightwell Security Advisory: jsoup 1.7.2.rhlw-00001
Details

Red Hat Lightwell has released org.jsoup:jsoup 1.7.2.rhlw-00001 with backported fixes for CVE-2015-6748 and CVE-2021-37714.

CVE-2015-6748: Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.

CVE-2021-37714: jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

This patched artifact is a drop-in replacement for org.jsoup:jsoup 1.7.2 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.jsoup:jsoup

Package

Name
org.jsoup:jsoup
Purl
pkg:maven/org.jsoup/jsoup

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.7.2.rhlw-00001

Affected versions

0.*
0.2.1b
0.2.2
0.3.1
1.*
1.1.1
1.2.1
1.2.2
1.2.3
1.3.1
1.3.2
1.3.3
1.4.1
1.5.1
1.5.2
1.6.0
1.6.1
1.6.2
1.6.3
1.7.1
1.7.2

Database specific

lightwell 
{
    "backport_base_version":  "1.7.2",
    "remediated_version":  "1.7.2.rhlw-00001",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-eaa1bbe31b9d0cc3.json"