jsoup CVE-2026-71497

jsoup (Maven: org.jsoup:jsoup) is a widely used Java library for HTML parsing and sanitization. Its Cleaner component applies Safelist rules to strip disallowed elements and attributes from untrusted HTML. Raw-text elements - script, style, textarea, title, xmp - are special: browsers treat their content as raw text rather than nested markup. The root cause (CWE-79) resided in two locations in the parser: Token.java applied ParseSettings.normalName() to tag names during tokenization, and TagSet.java called tagName.trim() unconditionally in Tag.valueOf(). A tag name like template (template plus ASCII Record Separator, U+001E) would be trimmed to template at serialization time, causing the parser to assign template's raw-text element semantics. The Safelist checked the original malformed name, which might pass as an allowed tag, while the tree builder treated the normalized name as a structurally different element - closing the gap between what the sanitizer approved and what the browser rendered. The fix (commit 92f1aca5) replaces ParseSettings.normalName() with lowerCase() in Token.java so control characters survive tree construction, and restricts the trim() call in TagSet.java to public API entry points only, where tokenizer-produced names are already delimited.