Bug 2512346 (CVE-2026-71497)

Summary:	CVE-2026-71497 org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abrianik, adinn, ant, anujha, aschwart, asoldano, aszczucz, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, bstansbe, cescoffi, chfoley, cmah, dandread, dbruscin, dkreling, dlofthou, drichtar, eaguilar, ebaron, ehugonne, ewittman, fzakkak, galder, ggrzybek, gsmet, istudens, ivassile, iweiss, janstey, jmartisk, jmatsuok, jraez, jtolenti, kvanderr, lthon, manderse, mbabacek, mosmerov, mposolda, msvehla, nipatil, nwallace, olubyans, pantinor, parichar, pberan, pesilva, pgallagh, pjindal, pmackay, probinso, rgodfrey, rguimara, rhel-process-autobot, rjohnson, rkubis, rmartinc, rruss, rstancel, rsvoboda, sbiarozk, sgehwolf, ssilvert, sthorger, swoodman, tasato, thjenkin, tqvarnst, vdosoudi, vmuzikar, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup after serialization. This could allow a remote attacker to achieve cross-site scripting (XSS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2512432, 2512434, 2512436, 2512438, 2512439, 2512433, 2512435, 2512437
Bug Blocks:

Description OSIDB Bzimport 2026-08-06 22:30:59 UTC

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.