Allocation of Resources Without Limits or Throttling in jsoup - CVE-2026-75140
Published: September 16, 2026
Vulnerability identifier: #VU150179
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-75140
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the XmlTreeBuilder namespace scope tracking when parsing untrusted XML input. A remote attacker can supply a deeply nested XML document with uniquely named namespace declarations to cause a denial of service.
Parsing documents with many nested namespace bindings grows quadratically in time and retained memory.
Affected software
jsoup
Crucible Data Center
Crucible Server
Crucible Data Center
Crucible Server
How to mitigate CVE-2026-75140
Install security update from vendor's website.
jsoup - update to 1.23.2
Crucible Data Center - update to 4.9.14
Crucible Server - update to 4.9.14
Crucible Data Center - update to 4.9.14
Crucible Server - update to 4.9.14