CVE-2021-37714 - CVE House

Back to Database

Status published High CVE-2021-37714

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

7.5 CVSS

Vulnerability Description

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-37714

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from jhy

View All →

jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled

Affected Vendor

jhy

View all reports →

Affected Software

jsoup

Vulnerable Versions:

< 1.14.2

Timeline

Official Publish: August 18th, 2021

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-835 CWE-248

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1562 Impair Defenses

Defense Evasion

T1485 Data Destruction

T1203 Exploitation for Client Execution

T1213 Data from Information Repositories

T1499.003 Application Exhaustion Flood