jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability     in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML     document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every     start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an     OutOfMemoryError and terminate the application. (CVE-2026-75140)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351399	SUSE SLED15 / SLES15 Security Update : jsoup, re2j (SUSE-SU-2026:4393-1)	Nessus	SuSE Local Security Checks	Local	high
350834	SUSE SLES16 Security Update : jsoup, re2j (SUSE-SU-2026:23867-1)	Nessus	SuSE Local Security Checks	Local	high
350139	openSUSE 16 Security Update : jsoup, re2j (openSUSE-SU-2026:21900-1)	Nessus	SuSE Local Security Checks	Local	high
338451	Linux Distros Unpatched Vulnerability : CVE-2026-75140	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-75140

high

Tenable Plugins

high

high

high

high