CVE-2026-71497 jhy CVE debrief

Who should care

Defenders responsible for applications using the jsoup library, especially those using custom Safelists, should assess their exposure and prioritize updating to version 1.23.1 or later.

Why it matters

CVE-2026-71497 is a vulnerability in the jsoup Java library that could allow for cross-site scripting (XSS) under certain conditions. Defenders should prioritize updating to jsoup version 1.23.1 or later, especially if using custom Safelists that permit raw-text elements.

• Potential for cross-site scripting (XSS) attacks
• Incorrect parsing of HTML tags leading to unexpected behavior
• Need for updating to jsoup version 1.23.1 or later
• Review and update of custom Safelists required

Technical summary

The jsoup library for Java, versions between 1.14.3 and 1.23.1, contains a vulnerability that could lead to cross-site scripting (XSS) when using custom Safelists that permit raw-text elements. The issue arises from the incorrect handling of malformed tag names ending in control characters, causing the tag to be parsed as a different element. This can result in inert text being emitted as active markup after serialization.

Defensive priority

Defenders should prioritize updating to jsoup version 1.23.1 or later, especially if using custom Safelists that permit raw-text elements.

Recommended defensive actions

• Update to jsoup version 1.23.1 or later
• Review and update custom Safelists to ensure they do not permit vulnerable elements
• Monitor for potential XSS attacks in applications using jsoup
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 4.7 and severity of MEDIUM. The issue is fixed in jsoup version 1.23.1. The vulnerability affects jsoup versions between 1.14.3 and 1.23.1. Defenders should verify the affected scope and review custom Safelists to ensure they do not permit vulnerable elements. The fix in version 1.23.1 addresses the incorrect handling of malformed tag names ending in control characters. Official sources confirm the vulnerability and provide guidance

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.