Allocation of Resources Without Limits or Throttling in jsoup - CVE-2026-75140

Vulnerability identifier: #VU150179

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-75140

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the XmlTreeBuilder namespace scope tracking when parsing untrusted XML input. A remote attacker can supply a deeply nested XML document with uniquely named namespace declarations to cause a denial of service.

Parsing documents with many nested namespace bindings grows quadratically in time and retained memory.

jsoup
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Development Tools Module
Crucible Server
Crucible Data Center
Maximo Real Estate and Facilities Management (MREF)
jsoup

Install security update from vendor's website.

jsoup - update to 1.23.2
Crucible Server - update to 4.9.14
Crucible Data Center - update to 4.9.14
Maximo Real Estate and Facilities Management (MREF) - addressed in versions 9.1.16, 9.2.4
jsoup - update to 1.23.2-150200.3.14.1

• https://security.snyk.io/vuln/SNYK-JAVA-ORGJSOUP-19233597
• https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a

• Allocation of Resources Without Limits or Throttling in jsoup
• Multiple vulnerabilities in Crucible Data Center and Crucible Server
• IBM Maximo Application Suite - MREF update for jsoup
• SUSE update for jsoup, re2j