jsoup jsoup CVE-2021-37714 vulnerability in Jsoup and Other Products
Published on August 18, 2021

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

product logo product logo product logo product logo product logo product logo
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Github Repository NVD

Vulnerability Analysis

CVE-2021-37714 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Types

What is an Infinite Loop Vulnerability?

The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.

CVE-2021-37714 has been classified to as an Infinite Loop vulnerability or weakness.

Uncaught Exception

An exception is thrown from a function, but it is not caught. When an exception is not caught, it may cause the program to crash or expose sensitive information.


Products Associated with CVE-2021-37714

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-37714 are published in these products:

Jsoup
 
Apache Maven
 
Apache Wagon Http
 
Quarkus
 
Oracle Primavera Unifier
 
Oracle Communications Messaging Server
 
Management Services Element Software Netapp Hci
 
Oracle Webcenter Portal
 
Oracle Business Process Management Suite
 
Oracle Flexcube Universal Banking
 
Oracle Peoplesoft Enterprise Peopletools
 
Oracle Banking Trade Finance
 
Oracle Banking Treasury Management
 
Oracle Hospitality Token Proxy Service
 
Oracle Retail Customer Management Segmentation Foundation
 
Oracle Middleware Common Libraries Tools
 
Oracle Financial Services Crime Compliance Management Studio
 
Oracle Stream Analytics
 
Oracle
 

Affected Versions

jhy jsoup Version < 1.14.2 is affected by CVE-2021-37714

Vulnerable Packages

The following package name and versions may be associated with CVE-2021-37714

Package Manager Vulnerable Package Versions Fixed In
maven org.jsoup:jsoup < 1.14.2 1.14.2

Exploit Probability

EPSS
4.35%
Percentile
88.71%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.