CVE-2021-37714: Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

Published Aug 18, 2021
·
Updated

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

Other sources

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

jsoup is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause the HTML and XML parser to get stuck, timeout, or throw unchecked exceptions resulting in a denial of service condition.

— IBM

Affected Software

68 affected componentsFixes available
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea
0:3.3.12-1.redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea
0:1.5.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea
0:3.0.3-3.redhat_00007.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea
0:4.0.43-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea
0:1.7.2-10.Final_redhat_00011.1.el6ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea
0:1.14.2-1.redhat_00002.1.el6ea
redhat/eap7-resteasy<0:3.11.5-1.Final_redhat_00001.1.el6ea
0:3.11.5-1.Final_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.41-1.SP1_redhat_00001.1.el6ea
0:2.0.41-1.SP1_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.10-2.GA_redhat_00003.1.el6ea
0:7.3.10-2.GA_redhat_00003.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.15-1.Final_redhat_00001.1.el6ea
0:1.10.15-1.Final_redhat_00001.1.el6ea
redhat/eap7-wss4j<0:2.2.7-1.redhat_00001.1.el6ea
0:2.2.7-1.redhat_00001.1.el6ea
redhat/eap7-xml-security<0:2.1.7-1.redhat_00001.1.el6ea
0:2.1.7-1.redhat_00001.1.el6ea
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el7ea
0:3.3.12-1.redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el7ea
0:1.5.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el7ea
0:3.0.3-3.redhat_00007.1.el7ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el7ea
0:4.0.43-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el7ea
0:1.7.2-10.Final_redhat_00011.1.el7ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el7ea
0:1.14.2-1.redhat_00002.1.el7ea
redhat/eap7-resteasy<0:3.11.5-1.Final_redhat_00001.1.el7ea
0:3.11.5-1.Final_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.41-1.SP1_redhat_00001.1.el7ea
0:2.0.41-1.SP1_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.10-2.GA_redhat_00003.1.el7ea
0:7.3.10-2.GA_redhat_00003.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.15-1.Final_redhat_00001.1.el7ea
0:1.10.15-1.Final_redhat_00001.1.el7ea
redhat/eap7-wss4j<0:2.2.7-1.redhat_00001.1.el7ea
0:2.2.7-1.redhat_00001.1.el7ea
redhat/eap7-xml-security<0:2.1.7-1.redhat_00001.1.el7ea
0:2.1.7-1.redhat_00001.1.el7ea
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el8ea
0:3.3.12-1.redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el8ea
0:1.5.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el8ea
0:3.0.3-3.redhat_00007.1.el8ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el8ea
0:4.0.43-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el8ea
0:1.7.2-10.Final_redhat_00011.1.el8ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el8ea
0:1.14.2-1.redhat_00002.1.el8ea
redhat/eap7-resteasy<0:3.11.5-1.Final_redhat_00001.1.el8ea
0:3.11.5-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.41-1.SP1_redhat_00001.1.el8ea
0:2.0.41-1.SP1_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.10-2.GA_redhat_00003.1.el8ea
0:7.3.10-2.GA_redhat_00003.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.15-1.Final_redhat_00001.1.el8ea
0:1.10.15-1.Final_redhat_00001.1.el8ea
redhat/eap7-wss4j<0:2.2.7-1.redhat_00001.1.el8ea
0:2.2.7-1.redhat_00001.1.el8ea
redhat/eap7-xml-security<0:2.1.7-1.redhat_00001.1.el8ea
0:2.1.7-1.redhat_00001.1.el8ea
jsoup jsoup<1.14.2
Quarkus Quarkus<=2.2.3
Oracle Banking Trade Finance=14.5
Oracle Banking Treasury Management=14.5
Oracle Business Process Management Suite=12.2.1.3.0
Oracle Business Process Management Suite=12.2.1.4.0
Oracle FLEXCUBE Universal Banking>=14.0.0<=14.3.0
Oracle FLEXCUBE Universal Banking=14.5
Oracle Hospitality Token Proxy Service=19.2
Oracle PeopleSoft Enterprise PeopleTools=8.58
Oracle PeopleSoft Enterprise PeopleTools=8.59
Oracle Primavera Unifier=20.12
Oracle Primavera Unifier=21.12
Oracle Retail Customer Management and Segmentation Foundation>=17.0<=19.0
Oracle WebCenter Portal=12.2.1.3.0
Oracle WebCenter Portal=12.2.1.4.0
Oracle Communications Messaging Server=8.1
NetApp Management Services For Element Software And Netapp Hci
Oracle Financial Services Crime And Compliance Management Studio=8.0.8.2.0
Oracle Financial Services Crime And Compliance Management Studio=8.0.8.3.0
Oracle Middleware Common Libraries And Tools=12.2.1.3.0
Oracle Middleware Common Libraries And Tools=12.2.1.4.0
Oracle Stream Analytics<19.1.0.0.6.4
Oracle Stream Analytics=19c
IBM Data Virtualization on Cloud Pak for Data<=3.0
IBM Watson Query on Cloud Pak for Data<=2.2
IBM Watson Query on Cloud Pak for Data<=2.1
IBM Watson Query on Cloud Pak for Data<=2.0
IBM Data Virtualization on Cloud Pak for Data<=1.8
IBM Data Virtualization on Cloud Pak for Data<=1.7
redhat/jsoup<1.14.2
1.14.2
Microsoft cbl2 jsoup
Patch available

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/eap7-apache-cxf to a version that resolves this vulnerability.

    Fixed in 0:3.3.12-1.redhat_00001.1.el6ea
  2. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.5.3-1.Final_redhat_00001.1.el6ea
  3. Upgrade

    Upgrade redhat/eap7-jakarta-el to a version that resolves this vulnerability.

    Fixed in 0:3.0.3-3.redhat_00007.1.el6ea
  4. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.43-1.Final_redhat_00001.1.el6ea
  5. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-10.Final_redhat_00011.1.el6ea
  6. Upgrade

    Upgrade redhat/eap7-jsoup to a version that resolves this vulnerability.

    Fixed in 0:1.14.2-1.redhat_00002.1.el6ea
  7. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.5-1.Final_redhat_00001.1.el6ea
  8. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.41-1.SP1_redhat_00001.1.el6ea
  9. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.10-2.GA_redhat_00003.1.el6ea
  10. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.15-1.Final_redhat_00001.1.el6ea
  11. Upgrade

    Upgrade redhat/eap7-wss4j to a version that resolves this vulnerability.

    Fixed in 0:2.2.7-1.redhat_00001.1.el6ea
  12. Upgrade

    Upgrade redhat/eap7-xml-security to a version that resolves this vulnerability.

    Fixed in 0:2.1.7-1.redhat_00001.1.el6ea
  13. Upgrade

    Upgrade redhat/eap7-apache-cxf to a version that resolves this vulnerability.

    Fixed in 0:3.3.12-1.redhat_00001.1.el7ea
  14. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.5.3-1.Final_redhat_00001.1.el7ea
  15. Upgrade

    Upgrade redhat/eap7-jakarta-el to a version that resolves this vulnerability.

    Fixed in 0:3.0.3-3.redhat_00007.1.el7ea
  16. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.43-1.Final_redhat_00001.1.el7ea
  17. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-10.Final_redhat_00011.1.el7ea
  18. Upgrade

    Upgrade redhat/eap7-jsoup to a version that resolves this vulnerability.

    Fixed in 0:1.14.2-1.redhat_00002.1.el7ea
  19. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.5-1.Final_redhat_00001.1.el7ea
  20. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.41-1.SP1_redhat_00001.1.el7ea
  21. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.10-2.GA_redhat_00003.1.el7ea
  22. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.15-1.Final_redhat_00001.1.el7ea
  23. Upgrade

    Upgrade redhat/eap7-wss4j to a version that resolves this vulnerability.

    Fixed in 0:2.2.7-1.redhat_00001.1.el7ea
  24. Upgrade

    Upgrade redhat/eap7-xml-security to a version that resolves this vulnerability.

    Fixed in 0:2.1.7-1.redhat_00001.1.el7ea
  25. Upgrade

    Upgrade redhat/eap7-apache-cxf to a version that resolves this vulnerability.

    Fixed in 0:3.3.12-1.redhat_00001.1.el8ea
  26. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.5.3-1.Final_redhat_00001.1.el8ea
  27. Upgrade

    Upgrade redhat/eap7-jakarta-el to a version that resolves this vulnerability.

    Fixed in 0:3.0.3-3.redhat_00007.1.el8ea
  28. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.43-1.Final_redhat_00001.1.el8ea
  29. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-10.Final_redhat_00011.1.el8ea
  30. Upgrade

    Upgrade redhat/eap7-jsoup to a version that resolves this vulnerability.

    Fixed in 0:1.14.2-1.redhat_00002.1.el8ea
  31. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.5-1.Final_redhat_00001.1.el8ea
  32. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.41-1.SP1_redhat_00001.1.el8ea
  33. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.10-2.GA_redhat_00003.1.el8ea
  34. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.15-1.Final_redhat_00001.1.el8ea
  35. Upgrade

    Upgrade redhat/eap7-wss4j to a version that resolves this vulnerability.

    Fixed in 0:2.2.7-1.redhat_00001.1.el8ea
  36. Upgrade

    Upgrade redhat/eap7-xml-security to a version that resolves this vulnerability.

    Fixed in 0:2.1.7-1.redhat_00001.1.el8ea
  37. Upgrade

    Upgrade redhat/jsoup to a version that resolves this vulnerability.

    Fixed in 1.14.2
  38. Upgrade

    Upgrade jsoup to a version that resolves this vulnerability.

    Fixed in 1.14.2Patch GHSA-m72m-mhq2-9p6c
  39. Compensating control

    If parsing untrusted HTML/XML, mitigate the denial-of-service risk by rate limiting input parsing, limiting the size of inputs based on system resources, and/or implementing thread watchdogs to cap and timeout parse runtimes.

Event History

Aug 18, 2021
CVE Published
12:00 AM
CVE Published
via MITRE·03:10 PM
Data Sourced
via MITRE·03:10 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·05:10 PM
DescriptionSeverityAffected Software
Aug 15, 2025
Data Sourced
via IBM·03:29 PM
DescriptionAffected Software
Oct 1, 2025
Data Sourced
via Microsoft·11:11 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·11:11 PM
Affected Software
Updated
via Microsoft·11:11 PM
DescriptionSeverity

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-37714?

CVE-2021-37714 is rated as a moderate severity vulnerability due to the potential for denial of service attacks.

2

How do I fix CVE-2021-37714?

To fix CVE-2021-37714, upgrade jsoup to version 1.14.2 or later.

3

What software is affected by CVE-2021-37714?

CVE-2021-37714 affects jsoup versions prior to 1.14.2 and various Red Hat packages that utilize jsoup.

4

What are the potential impacts of CVE-2021-37714?

The impact of CVE-2021-37714 includes the possibility of denial of service if an attacker targets applications using the vulnerable jsoup library.

5

Can I mitigate CVE-2021-37714 without upgrading?

Mitigation options for CVE-2021-37714 are limited; upgrading to a non-vulnerable version is the best approach.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203