CVE-2026-75140 jhy CVE debrief

Who should care

Defenders responsible for applications that use jsoup, particularly those that process XML documents, should assess exposure and prioritize verification and remediation. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams that need to ensure the security and stability of their environments.

Why it matters

CVE-2026-75140 is a high-severity vulnerability in jsoup that can lead to application termination and denial-of-service attacks. Defenders should prioritize verification and remediation to prevent potential impacts.

• Potential application termination due to OutOfMemoryError
• Increased risk of denial-of-service attacks
• Need for verification of jsoup version and exposure to deeply nested XML documents
• Potential for performance degradation due to excessive memory usage

Technical summary

The vulnerability is caused by the XmlTreeBuilder component in jsoup, which can be exploited by remote attackers to exhaust JVM heap memory by providing a deeply nested XML document with uniquely-namespaced elements. This can lead to an OutOfMemoryError and terminate the application. The issue arises from the builder copying the entire inherited namespace map on every start element, causing quadratic time and memory complexity. Defenders should prioritize verifying and updating jsoup to a version that includes the fix, as well as monitoring for and limiting exposure to deeply nested XML documents.

Defensive priority

Defenders should prioritize verifying and updating jsoup to a version that includes the fix, as well as monitoring for and limiting exposure to deeply nested XML documents.

Recommended defensive actions

• Verify and update jsoup to a version that includes the fix
• Monitor for and limit exposure to deeply nested XML documents
• Implement memory limits and monitoring to detect potential OutOfMemoryErrors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code changes and advisories. Defenders should verify jsoup version and exposure to deeply nested XML documents. Evidence limits suggest focusing on official sources and CVE details. The vulnerability allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements, potentially leading to an OutOfMemoryError and application termination.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.