Soup
Monthly
Uncontrolled resource consumption in jsoup through version 1.23.2 allows remote unauthenticated attackers to crash JVM-based applications by submitting deeply nested XML with unique namespace declarations per element. The XmlTreeBuilder component copied the full inherited namespace HashMap at every XML start element, producing O(n²) time and memory growth that exhausts heap and triggers an OutOfMemoryError. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects zero authentication or complexity barriers - any application that feeds user-supplied XML through jsoup is directly at risk.
Uncontrolled resource consumption in jsoup through version 1.23.2 allows remote unauthenticated attackers to crash JVM-based applications by submitting deeply nested XML with unique namespace declarations per element. The XmlTreeBuilder component copied the full inherited namespace HashMap at every XML start element, producing O(n²) time and memory growth that exhausts heap and triggers an OutOfMemoryError. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects zero authentication or complexity barriers - any application that feeds user-supplied XML through jsoup is directly at risk.