CVE-2021-37714: Jsoup

High severity, CVSS 7.5. EPSS: 6.7% chance of exploitation in the next 30 days.

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Affected products

Jsoup Jsoup: before 1.14.2 (fixed in 1.14.2)
Netapp Management Services For Element Software And Netapp Hci: affected versions not specified
Oracle Banking Trade Finance: version 14.5 only
Oracle Banking Treasury Management: version 14.5 only
Oracle Business Process Management Suite: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Communications Messaging Server: version 8.1 only
Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
Oracle Flexcube Universal Banking: from 14.0.0, up to and including 14.3.0; version 14.5 only
Oracle Hospitality Token Proxy Service: version 19.2 only
Oracle Middleware Common Libraries And Tools: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
Oracle Primavera Unifier: version 20.12 only; version 21.12 only
Oracle Retail Customer Management And Segmentation Foundation: from 17.0, up to and including 19.0
Oracle Stream Analytics: before 19.1.0.0.6.4 (fixed in 19.1.0.0.6.4); version 19c only
Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Quarkus Quarkus: up to and including 2.2.3

Published 2021-08-18. Last modified 2026-10-08.