GHSA-m72m-mhq2-9p6c · Severity: high · Ecosystem: maven — Uncaught Exception in jsoup
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
Conclusion & alert: CVE-2021-37714 is rated Moderate Risk (64.5/100): CVSS High severity, with medium exploitation likelihood (EPSS 4.35%). Core evidence: EPSS rose +3.47% over the last day, indicating growing attacker interest. Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-04 | 0.88% | 4.35% | +3.47% |
| 2 | 2026-03-01 | 4.35% | 0.88% | -3.47% |
| 3 | 2026-02-04 | — | 4.35% | — |
Full EPSS history (40 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
GHSA-m72m-mhq2-9p6c · Severity: high · Ecosystem: maven — Uncaught Exception in jsoup
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2021-37714 not yet assigned priority: Debian including 1 source packages (jsoup), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 4, open 1. | https://security-tracker.debian.org/tracker/CVE-2021-37714 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-37714 |
suse
|
high | CVE-2021-37714 severity important: SUSE including 21 source package names (11-6.2:jsoup-1.14.2-150200.3.3.1, 11-6.2:jsr-305-3.0.2-150200.3.3.1, …), 63 product×package rows across 30 product lines (Container bci/openjdk-devel, Container containers/apache-pulsar, … (30 product lines)): Fixed 63. | https://www.suse.com/security/cve/CVE-2021-37714/ |
ubuntu
|
low | CVE-2021-37714 low priority: Ubuntu including 1 source packages (jsoup), 15 status rows across 15 suites (bionic, focal, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): not-affected 6, needs-triage 5, ignored 3, released 1. | https://ubuntu.com/security/CVE-2021-37714 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| jsoup | jsoup | < 1.14.2 | cpe:2.3:a:jsoup:jsoup:*:*:*:*:*:*:*:* |
| quarkus | quarkus | <= 2.2.3 | cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* |
| oracle | banking_trade_finance | 14.5 | cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* |
| oracle | banking_treasury_management | 14.5 | cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* |
| oracle | business_process_management_suite | 12.2.1.3.0 | cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | business_process_management_suite | 12.2.1.4.0 | cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | flexcube_universal_banking | >= 14.0.0, <= 14.3.0 | cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* |
| oracle | flexcube_universal_banking | 14.5 | cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* |
| oracle | hospitality_token_proxy_service | 19.2 | cpe:2.3:a:oracle:hospitality_token_proxy_service:19.2:*:*:*:*:*:*:* |
| oracle | peoplesoft_enterprise_peopletools | 8.58 | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* |
| oracle | peoplesoft_enterprise_peopletools | 8.59 | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* |
| oracle | primavera_unifier | 20.12 | cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* |
| oracle | primavera_unifier | 21.12 | cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* |
| oracle | retail_customer_management_and_segmentation_foundation | >= 17.0, <= 19.0 | cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* |
| oracle | webcenter_portal | 12.2.1.3.0 | cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | webcenter_portal | 12.2.1.4.0 | cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | communications_messaging_server | 8.1 | cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* |
| netapp | management_services_for_element_software_and_netapp_hci | — | cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* |
| oracle | financial_services_crime_and_compliance_management_studio | 8.0.8.2.0 | cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* |
| oracle | financial_services_crime_and_compliance_management_studio | 8.0.8.3.0 | cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* |
| oracle | middleware_common_libraries_and_tools | 12.2.1.3.0 | cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | middleware_common_libraries_and_tools | 12.2.1.4.0 | cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | stream_analytics | < 19.1.0.0.6.4 | cpe:2.3:a:oracle:stream_analytics:*:*:*:*:*:*:*:* |
| oracle | stream_analytics | 19c | cpe:2.3:a:oracle:stream_analytics:19c:*:*:*:*:*:*:* |