Vulnerability Database · Maven · Package report
com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer: vulnerability history, versions and safety
com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer is a package in the Maven ecosystem. Vulert records 3 vulnerabilities for it across 47 releases, from Oct 2021 to Nov 2025. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.
No patched version yet — these are the ones to plan around.
See the unfixed vulnerabilities →No published version shipped hostile code.
See all com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer vulnerabilities
Vulert verdict on com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 20261011.1 i
Updated on 23 Oct 2026
Careful: 20261011.1 has 1 known vulnerability, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.
- Security Some issues to review
- Maintenance Sustainable
- Popularity Niche
- Community Moderate
The current release has a vulnerability with no published fix, which caps this score.
What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →
- Current release 20261011.1 — affected i
- Vulnerabilities on record 3 over 4 years · 1 in the last year i
- Latest disclosure 25 Nov 2025 i
- Highest CVSS 9.8 i
- With no published fix 1 i
- Depended on by 7 packages i
- Stars 958 i
- OpenSSF scorecard 5/10 i
- Last release this month i
- Licence Apache-2.0 i
Version list, release dates, licence and dependants published by Maven Central, refreshed 23 Oct 2026. Licence information is not legal advice.
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Versions
Which versions are affected
Every version Vulert tracks for com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.
- 20261011.1 11 Oct 2026
- 20260924.2 25 Sep 2026
- 20260924.1 25 Sep 2026
- 20260922.1 22 Sep 2026
- 20260921.1 21 Sep 2026
- 20260313.1 13 Mar 2026
- 20260102.1 03 Jan 2026
- 20260101.1 01 Jan 2026
- 20240325.1 25 Mar 2024
- 20220608.1 08 Jun 2022
- 20211018.2 18 Oct 2021
- 20211018.1 18 Oct 2021
- 20200713.1 13 Jul 2020
- 20200615.1 15 Jun 2020
- 20191001.1 02 Oct 2019
- 20190610.1 10 Jun 2019
- 20190503.1 03 May 2019
- 20190325.1 25 Mar 2019
- 20181114.1 14 Nov 2018
- 20180219.1 19 Feb 2018
- 20171016.1 16 Oct 2017
- 20170515.1 15 May 2017
- 20170512.1 12 May 2017
- 20170411.1 12 Apr 2017
- 20170408.1 08 Apr 2017
- 20170329.1 29 Mar 2017
- 20160924.1 24 Sep 2016
- 20160827.1 27 Aug 2016
- 20160628.1 28 Jun 2016
- 20160614.1 14 Jun 2016
- 20160526.1 26 May 2016
- 20160422.1 22 Apr 2016
- 20160413.1 14 Apr 2016
- 20160203.1 03 Feb 2016
- 20151202.2 02 Dec 2015
- 1.1 08 Oct 2015
- 20150501.1 02 May 2015
- r239 02 Jun 2014
- r232 07 May 2014
- r223 28 Feb 2014
- r209 04 Sep 2013
- r198 22 Jul 2013
- r173 16 May 2013
- r164 02 May 2013
- r163 24 Apr 2013
- r156 26 Feb 2013
- r136 25 Jan 2013
| Version | Released | Vulert vulnerabilities | Licence | Fix published | Details |
|---|---|---|---|---|---|
| 20261011.1 | 11 Oct 2026 | H1 | Apache-2.0 | No | Details → |
| 20260924.2 | 25 Sep 2026 | H1 | Apache-2.0 | No | Details → |
| 20260924.1 | 25 Sep 2026 | H1 | Apache-2.0 | No | Details → |
| 20260922.1 | 22 Sep 2026 | H1 | Apache-2.0 | No | Details → |
| 20260921.1 | 21 Sep 2026 | H1 | Apache-2.0 | No | Details → |
| 20260313.1 | 13 Mar 2026 | H1 | Apache-2.0 | No | Details → |
| 20260102.1 | 03 Jan 2026 | H1 | Apache-2.0 | No | Details → |
| 20260101.1 | 01 Jan 2026 | H1 | Apache-2.0 | No | Details → |
| 20240325.1 | 25 Mar 2024 | H1 | Apache-2.0 | No | Details → |
| 20220608.1 | 08 Jun 2022 | H1 | Apache-2.0 | No | Details → |
| 20211018.2 | 18 Oct 2021 | H1 | Apache-2.0 | No | Details → |
| 20211018.1 | 18 Oct 2021 | H1 | Apache-2.0 | No | Details → |
| 20200713.1 | 13 Jul 2020 | C1 | Apache-2.0 | Yes | Details → |
| 20200615.1 | 15 Jun 2020 | C1 | Apache-2.0 | Yes | Details → |
| 20191001.1 | 02 Oct 2019 | C1 | Apache-2.0 | Yes | Details → |
| 20190610.1 | 10 Jun 2019 | C1 | Apache-2.0 | Yes | Details → |
| 20190503.1 | 03 May 2019 | C1 | Apache-2.0 | Yes | Details → |
| 20190325.1 | 25 Mar 2019 | C1 | Apache-2.0 | Yes | Details → |
| 20181114.1 | 14 Nov 2018 | C1 | Apache-2.0 | Yes | Details → |
| 20180219.1 | 19 Feb 2018 | C1 | Apache-2.0 | Yes | Details → |
| 20171016.1 | 16 Oct 2017 | C1 | Apache-2.0 | Yes | Details → |
| 20170515.1 | 15 May 2017 | C1 | Apache-2.0 | Yes | Details → |
| 20170512.1 | 12 May 2017 | C1 | Apache-2.0 | Yes | Details → |
| 20170411.1 | 12 Apr 2017 | C1 | Apache-2.0 | Yes | Details → |
| 20170408.1 | 08 Apr 2017 | C1 | Apache-2.0 | Yes | Details → |
| 20170329.1 | 29 Mar 2017 | C1 | Apache-2.0 | Yes | Details → |
| 20160924.1 | 24 Sep 2016 | C1 | Apache-2.0 | Yes | Details → |
| 20160827.1 | 27 Aug 2016 | C1 | Apache-2.0 | Yes | Details → |
| 20160628.1 | 28 Jun 2016 | C1 | Apache-2.0 | Yes | Details → |
| 20160614.1 | 14 Jun 2016 | C1 | Apache-2.0 | Yes | Details → |
| 20160526.1 | 26 May 2016 | C1 | Apache-2.0 | Yes | Details → |
| 20160422.1 | 22 Apr 2016 | C1 | Apache-2.0 | Yes | Details → |
| 20160413.1 | 14 Apr 2016 | C1 | Apache-2.0 | Yes | Details → |
| 20160203.1 | 03 Feb 2016 | C1 | Apache-2.0 | Yes | Details → |
| 20151202.2 | 02 Dec 2015 | C1 | Apache-2.0 | Yes | Details → |
| 1.1 | 08 Oct 2015 | C1 L1 | Apache-2.0 | Yes | Details → |
| 20150501.1 | 02 May 2015 | C1 | Apache-2.0 | Yes | Details → |
| r239 | 02 Jun 2014 | C1 L1 | non-standard | Yes | Details → |
| r232 | 07 May 2014 | C1 L1 | non-standard | Yes | Details → |
| r223 | 28 Feb 2014 | C1 L1 | non-standard | Yes | Details → |
| r209 | 04 Sep 2013 | C1 L1 | non-standard | Yes | Details → |
| r198 | 22 Jul 2013 | C1 L1 | non-standard | Yes | Details → |
| r173 | 16 May 2013 | C1 L1 | non-standard | Yes | Details → |
| r164 | 02 May 2013 | C1 L1 | non-standard | Yes | Details → |
| r163 | 24 Apr 2013 | C1 L1 | non-standard | Yes | Details → |
| r156 | 26 Feb 2013 | C1 L1 | non-standard | Yes | Details → |
| r136 | 25 Jan 2013 | C1 L1 | non-standard | Yes | Details → |
All 47 versions Vulert tracks for this package. Severity counts are the vulnerabilities recorded against that exact release.
02 Disclosure history
How often vulnerabilities are recorded
Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 1 of the 3 were recorded in the last 12 months.
03 Vulnerabilities
Recorded vulnerabilities for com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer
| Vulnerability | Severity | Fixed version ↓ | Disclosed ↓ |
|---|---|---|---|
| CVE-2021-42575: OWASP Java HTML Sanitizer - Policies Not Properly Enforced | 9.8 critical | 20211018.1 | 19 Oct 2021 |
| CVE-2025-66021: OWASP Java HTML Sanitizer Vulnerable to XSS via noscript and style Tag Misconfiguration | 8.6 high | No fix published | 25 Nov 2025 |
| CVE-2011-4457: OWASP HTML Sanitizer allows redirecting to an arbitrary URL when JavaScript is disabled | N/A low | 88 | 17 May 2022 |
Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback
Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315
