Description

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T16:18:02.030Z",
  "pubdate": "2026-08-20T16:18:02.030Z",
  "executiveSummary": "An uncontrolled resource consumption vulnerability exists in jsoup through version 1.23.2 within the XmlTreeBuilder component, which allows remote attackers to exhaust JVM heap memory and cause an OutOfMemoryError, ultimately resulting in application termination.\nThe vulnerability arises from algorithmic complexity during the parsing of deeply nested XML documents containing uniquely-namespaced elements.\nAffected systems include applications utilizing jsoup versions up to 1.23.2 for parsing untrusted XML inputs.\nThe risk implications are severe as successful exploitation leads to denial of service (DoS) through complete service disruption.\nAn unauthenticated remote attacker can exploit this vulnerability by supplying a crafted malicious payload over the network without requiring any special privileges.\nExploitation requirements are minimal, relying solely on the application's ingestion of attacker-supplied XML documents that trigger quadratic time and memory consumption during processing.",
  "technicalDetails": "The root cause of the vulnerability resides in the XmlTreeBuilder component of jsoup, specifically in how namespace maps are managed during the parsing of XML start elements.\nIn vulnerable versions up to 1.23.2, the builder copies the entire inherited namespace map upon encountering every start element in an XML document.\nWhen processing a deeply nested XML document characterized by uniquely-namespaced elements, this behavior introduces quadratic time and memory complexity ($O(n^2)$), rapidly consuming available JVM heap resources.\nThe vulnerable component is identified as the XmlTreeBuilder class within the jsoup library.\nThe attack flow proceeds as follows: 1) A remote, unauthenticated attacker crafts a malicious XML payload consisting of a deep hierarchy of elements, each introducing unique namespaces. 2) The attacker transmits this payload to a network-exposed application utilizing jsoup to parse XML. 3) As the XmlTreeBuilder processes the document, it recursively duplicates the inherited namespace maps for each nested start element. 4) The cumulative memory allocations scale quadratically relative to the depth and namespace count of the document. 5) The JVM heap memory is fully exhausted, triggering an OutOfMemoryError and abruptly terminating the host application process.\nNetwork exposure is present wherever the application accepts and parses untrusted XML data over network protocols without prior input validation or depth limitations.\nAuthentication and privilege requirements are absent, meaning any remote entity capable of interacting with the parsing endpoint can initiate the attack payload.\nThe post-exploitation impact is strictly localized to denial of service via application crash, as arbitrary code execution is not facilitated by this specific resource exhaustion vector."
}