These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-75140 is an uncontrolled resource consumption vulnerability in jsoup through version 1.23.2. The vulnerability is caused by the XmlTreeBuilder component, which can be exploited by remote attackers to exhaust JVM heap memory by providing a deeply nested XML document with uniquely-namespaced elements. This can lead to an OutOfMemoryError and terminate the application.
This debrief provides an analysis of CVE-2026-71497, a vulnerability in the jsoup Java library used for parsing HTML. The vulnerability could allow for cross-site scripting (XSS) under certain conditions when using custom Safelists. The issue arises from the incorrect handling of malformed tag names ending in control characters, causing the tag to be parsed as a different element. This can result in inert [truncated]