High [CVE-2026-75140] Denial of Service via deeply nested XML documents
This high-severity Red Hat Linux advisory covers CVE-2026-75140 affecting Exploit Intelligence, Migration Toolkit for Applications 8, OpenShift Developer Tools and Services.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements.
The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application. A flaw was found in jsoup.
Successful exploitation could exhaust JVM heap memory, resulting in an OutOfMemoryError and terminating the application, effectively causing a Denial of Service (DoS). Parsing deeply nested XML documents can cause a denial of service via excessive stack consumption, leading to a StackOverflowError.
An attacker who can supply untrusted XML input to an application using jsoup for parsing can exploit this to crash the application or exhaust system resources. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-1050.
Affected products named by the advisory: Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Developer Tools and Services; Red Hat AMQ Broker 7; and 13 more.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 55 minutes ago·verify at source
- 1.23.2
Official advisory · high-confidence parse· fetched 55 minutes ago·verify at source
Mitigation checklist
- Validate and limit the nesting depth of XML documents before passing them to jsoup for parsing. Applications should implement input size limits and consider using iterative XML parsers for untrusted input. Where possible, restrict the sources of XML input to trusted origins only.
Official advisory · high-confidence parse· fetched 55 minutes ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.