CVE-2026-75140
Received Received - Intake

XmlTreeBuilder Heap Exhaustion in jsoup

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-75140
EUVD
EUVD-2026-63476

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jsoup jsoup to 1.23.1 (inc)
jsoup jsoup to 1.23.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75140 is an uncontrolled resource consumption vulnerability in jsoup versions up to 1.23.2. The XmlTreeBuilder component copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity. Attackers can exploit this by submitting a deeply nested XML document with uniquely-namespaced elements to exhaust JVM heap memory, triggering an OutOfMemoryError and terminating the application.

Detection Guidance

To detect this vulnerability, monitor for OutOfMemoryError exceptions in applications using jsoup versions <= 1.23.1. Check logs for deeply nested XML parsing attempts. Use tools like jstack or VisualVM to analyze heap usage during XML parsing operations.

Impact Analysis

This vulnerability can cause denial-of-service by crashing applications that parse XML using jsoup. Systems processing untrusted XML inputs may become unresponsive or terminate unexpectedly, leading to service disruption. The impact depends on the application's reliance on jsoup for XML parsing and the availability of the affected service.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing application crashes due to OutOfMemoryError, potentially leading to service disruptions or data processing failures. GDPR requires systems to ensure availability and resilience, while HIPAA mandates secure and reliable data handling. An application crash may violate these requirements if it disrupts data processing or access.

Mitigation Strategies

Upgrade jsoup to version 1.23.2 or later. If upgrading is not possible, restrict XML input sources and validate XML structure to prevent deeply nested documents. Monitor memory usage during XML parsing operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75140. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart