CVE-2021-37714 Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

High 7.5 Published 18 Aug 2021 Updated 8 Oct 2026

Attackers can cause denial of service in applications using the jsoup library by supplying crafted HTML or XML input that triggers infinite loops or exceptions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-37714?

CVE-2021-37714 is a high-severity denial of service vulnerability in Oracle Flexcube Universal Banking, published on 18 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Weakness: CWE-835, CWE-248

Which versions are affected by CVE-2021-37714?

2 open source packages ship an affected version, including org.jsoup:jsoup. It affects 16 products.

Package	Affected	Fixed in
`org.jsoup:jsoup` Maven	All versions	`1.14.2`
`org.jsoup:jsoup` Maven	All versions	`1.14.2`

Linux distribution packages (26)

`jsoup` SUSE:Enterprise Storage 7	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Enterprise Storage 7	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Linux Enterprise Module for Development Tools 15 SP3	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Linux Enterprise Module for Development Tools 15 SP3	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Linux Enterprise Real Time 15 SP2	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Linux Enterprise Real Time 15 SP2	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Linux Enterprise Server 15 SP2-BCL	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Linux Enterprise Server 15 SP2-BCL	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Manager Proxy 4.1	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Manager Proxy 4.1	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Manager Retail Branch Server 4.1	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Manager Retail Branch Server 4.1	All versions	`3.0.2-150200.3.3.1`
`jsoup` SUSE:Manager Server 4.1	All versions	`1.14.2-150200.3.3.1`
`jsr-305` SUSE:Manager Server 4.1	All versions	`3.0.2-150200.3.3.1`
`jsoup` openSUSE:Leap 15.3	All versions	`1.14.2-150200.3.3.1`
`jsr-305` openSUSE:Leap 15.3	All versions	`3.0.2-150200.3.3.1`
`jsoup` openSUSE:Tumbleweed	All versions	`1.14.2-1.2`
`jsr-305` openSUSE:Tumbleweed	All versions	`3.0.2-1.2`

Products include Jsoup Jsoup, Netapp Management Services for Element Software and Netapp Hci, Oracle Banking Trade Finance, Oracle Banking Treasury Management, Oracle Business Process Management Suite, Oracle Communications Messaging Server and 10 more.

How do I fix CVE-2021-37714?

Upgrade org.jsoup:jsoup to 1.14.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-37714 being exploited?

There is no known exploitation of CVE-2021-37714 in the wild and no public exploit code.

CVE-2022-36033 jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled Medium 6.1

All Oracle Flexcube Universal Banking vulnerabilities

Sources

Also known as AZL-36945, AZL-7253, CLSA-2026-1784900402, DEBIAN-CVE-2021-37714, GHSA-m72m-mhq2-9p6c, OESA-2021-1335 and 4 more.