jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser
    could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire
    the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements,
    this misparsing can cause content that should remain inert text to be emitted as active markup after
    serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected.
    This issue is fixed in version 1.23.1. (CVE-2026-71497)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser     could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire     the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements,     this misparsing can cause content that should remain inert text to be emitted as active markup after     serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected.
    This issue is fixed in version 1.23.1. (CVE-2026-71497)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445753	SCA: security update for org.jsoup:jsoup (GHSA-pmhh-3w7g-xqp8)	Tenable Cloud Security	SCA Checks	Local	medium
445753	SCA: security update for org.jsoup:jsoup (GHSA-pmhh-3w7g-xqp8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
333319	Linux Distros Unpatched Vulnerability : CVE-2026-71497	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-71497

medium

Tenable Plugins

medium

medium

medium