CVE-2021-37714

Name	CVE-2021-37714
Description	jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	992590

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jsoup (PTS)	jessie, jessie (lts)	1.8.1-1+deb8u1	vulnerable
	stretch	1.10.2-1	vulnerable
	buster, bullseye	1.10.2-2	vulnerable
	sid, trixie, bookworm	1.15.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jsoup	source	(unstable)	1.14.2-1			992590

Notes

[bullseye] - jsoup <no-dsa> (Minor issue)
[buster] - jsoup <no-dsa> (Minor issue)
[stretch] - jsoup <no-dsa> (Minor issue)
https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c
[jessie] - jsoup <ignored> (likely only needed as a Maven dependency and too instrusive to backport)