[From nobody Fri Sep 18 22:37:09 2026
Received: (at submit) by bugs.debian.org; 8 Aug 2026 08:35:12 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.9 required=4.0 tests=BAYES_00,FOURLA,
 FROMDEVELOPER,MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 23; hammy, 149; neutral, 66; spammy,
 1. spammytokens:0.941-+--H*r:bugs.debian.org
 hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc,
 0.000-+--H*F:U*carnil, 0.000-+--trixie, 0.000-+--bookworm
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wscWM-001X3P-2F
 for submit@bugs.debian.org; Sat, 08 Aug 2026 08:35:12 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: jsoup: CVE-2026-71497
Message-ID: <178617810962.24435.9744744523508911450.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0+nmu1
Date: Sat, 08 Aug 2026 10:35:09 +0200
Delivered-To: submit@bugs.debian.org

Source: jsoup
Version: 1.15.3-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/jhy/jsoup/issues/2538
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for jsoup.

Note I'm making this RC leve as we have the same version present in
bookworm, trixie, forky and sid. For forky this should thus be
defintively RC to make sure we move to a newer upstream version?

CVE-2026-71497[0]:
| jsoup is a Java library for working with real-world HTML. From
| 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a
| malformed tag name ending in a control character, causing the tag to
| acquire the parsing behavior of a different element. When a custom
| Safelist permits certain raw-text elements, this misparsing can
| cause content that should remain inert text to be emitted as active
| markup after serialization, potentially resulting in cross-site
| scripting. jsoup's built-in Safelists are not affected. This issue
| is fixed in version 1.23.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-71497
    https://www.cve.org/CVERecord?id=CVE-2026-71497
[1] https://github.com/jhy/jsoup/issues/2538
[2] https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8
[4] https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70

Regards,
Salvatore
]