Security Exception in org.jsoup.parser.HtmlTreeBuilder.process

jsoup Updated 02 Oct 2025

Summary

14/10/2023

Disclosed on

LOW

Severity

Yes i

Fix available

Low

Severity

Not published

CVSS Score

OSV-2023-1014: Security exception in org.jsoup.parser.HtmlTreeBuilder.process. Affects jsoup across 2 version ranges.

>= 26cfb42bd468351092ff1acb2f16ac2311d2b536, < d61ec5a78f9f220b2535a93d82851262a29d9f0b < 545145a3176585c989c8c5e9a90f4257796c46d9

Fixed in d61ec5a78f9f220b2535a93d82851262a29d9f0b. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The package under scrutiny is jsoup, an open-source Java library used for parsing HTML documents. It provides a convenient API for extracting and manipulating data from HTML files. The vulnerability affects the HtmlTreeBuilder class within the library. This class is responsible for parsing HTML and constructing a parse tree. The vulnerability arises in the process method of the HtmlTreeBuilder, specifically in the handleMissingTr method of the HtmlTreeBuilderState. The vulnerability allows for a security exception to occur during the parsing process.

Vulnerability Detail

The vulnerability in org.jsoup.parser.HtmlTreeBuilder.process can lead to a security exception. This exception can be triggered when the parser encounters a missing 'tr' element in an HTML table. The handleMissingTr method, responsible for handling this scenario, fails to properly handle the exception, resulting in a crash. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) or execute arbitrary code. The vulnerability has been assigned a low severity rating.

How To Fix

Minimum fixed version

d61ec5a78f9f220b2535a93d82851262a29d9f0b

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a workaround, developers can manually handle the missing 'tr' element in their code. This can be done by checking for the presence of the 'tr' element before invoking the HtmlTreeBuilder.process method. If the 'tr' element is missing, alternative logic can be implemented to handle the situation appropriately.

Conclusion

In conclusion, the vulnerability in org.jsoup.parser.HtmlTreeBuilder.process can lead to a security exception. It is recommended to update the jsoup library to a version that includes the fix. Alternatively, developers can implement a workaround to handle the missing 'tr' element. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for jsoup →