# CVE-2021-37714: Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions > Attackers can cause denial of service in applications using the jsoup library by supplying crafted HTML or XML input that triggers infinite loops or exceptions. - **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 18 Aug 2021 - **Updated:** 8 Oct 2026 - **Also known as:** AZL-36945, AZL-7253, CLSA-2026-1784900402, DEBIAN-CVE-2021-37714, GHSA-m72m-mhq2-9p6c, OESA-2021-1335, SUSE-SU-2022:1265-1, UBUNTU-CVE-2021-37714, openSUSE-SU-2024:10882-1, openSUSE-SU-2024:10883-1 ## What is CVE-2021-37714? CVE-2021-37714 is a high-severity denial of service vulnerability in Oracle Flexcube Universal Banking, published on 18 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes. Weakness: CWE-835 (Loop with Unreachable Exit Condition), CWE-248 (Uncaught Exception) ## Which versions are affected by CVE-2021-37714? 2 open source packages ship an affected version, including org.jsoup:jsoup. It affects 16 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `org.jsoup:jsoup` | Maven | All versions | 1.14.2 | | `org.jsoup:jsoup` | Maven | All versions | 1.14.2 | | `jsoup` | SUSE:Enterprise Storage 7 | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Enterprise Storage 7 | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Linux Enterprise Real Time 15 SP2 | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Linux Enterprise Real Time 15 SP2 | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Manager Proxy 4.1 | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Manager Proxy 4.1 | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Manager Retail Branch Server 4.1 | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Manager Retail Branch Server 4.1 | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | SUSE:Manager Server 4.1 | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | SUSE:Manager Server 4.1 | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | openSUSE:Leap 15.3 | All versions | 1.14.2-150200.3.3.1 | | `jsr-305` | openSUSE:Leap 15.3 | All versions | 3.0.2-150200.3.3.1 | | `jsoup` | openSUSE:Tumbleweed | All versions | 1.14.2-1.2 | | `jsr-305` | openSUSE:Tumbleweed | All versions | 3.0.2-1.2 | Products: Jsoup Jsoup, Netapp Management Services for Element Software and Netapp Hci, Oracle Banking Trade Finance, Oracle Banking Treasury Management, Oracle Business Process Management Suite, Oracle Communications Messaging Server, Oracle Financial Services Crime and Compliance Management Studio, Oracle Flexcube Universal Banking, Oracle Hospitality Token Proxy Service, Oracle Middleware Common Libraries and Tools, Oracle Peoplesoft Enterprise Peopletools, Oracle Primavera Unifier, Oracle Retail Customer Management and Segmentation Foundation, Oracle Stream Analytics, Oracle Webcenter Portal, Quarkus Quarkus. ## How do I fix CVE-2021-37714? Upgrade org.jsoup:jsoup to 1.14.2 or later. ## Is CVE-2021-37714 being exploited? There is no known exploitation of CVE-2021-37714 in the wild and no public exploit code. ## Other vulnerabilities in Oracle Flexcube Universal Banking - [CVE-2022-36033](https://insights.sbomify.com/CVE-2022-36033/): jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled (medium 6.1) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2021-37714 and fix it if it is affected. What it is: CVE-2021-37714 is a high-severity denial of service vulnerability in Oracle Flexcube Universal Banking, published on 18 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of CVE-2021-37714 in the wild and no public exploit code. Affected packages and fixed versions: - org.jsoup:jsoup (Maven): affected all versions; fixed in 1.14.2 - org.jsoup:jsoup (Maven): affected all versions; fixed in 1.14.2 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2021-37714/ (Markdown: https://insights.sbomify.com/CVE-2021-37714/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2021-37714 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-37714 - OSV: https://osv.dev/vulnerability/CVE-2021-37714 --- From sbomify Insights: https://insights.sbomify.com/CVE-2021-37714/ Summaries are generated and may contain mistakes; the official description above is the record.