jsoup: Cleaner may expose markup with custom raw-text elements
CVE-2026-71497 is fixed in jsoup on 1 platform, first by DEBIAN-CVE-2026-71497, released August 6, 2026. It is not reported as exploited. Patch Radar priority: Routine.
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| jsoup · Debian 14 | 1.23.2-1 | DEBIAN-CVE-2026-71497 | Aug 6, 2026 |
| jsoup · amzn 2023 | 1.23.2-1.amzn2023.0.1 | ALAS2023-2026-2150 | Sep 14, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.