UnratedFix available

Security update for jsoup, re2j

Type: advisorySource: OSV1 source record

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application (bsc#1275912). Changes for jsoup: - Upgrade to upstream version 1.23.2 * Changes of 1.23.2 + Improvement: Improved consecutive StreamParser.selectFirst() calls during progressive parsing, so later matches are returned with their parsed contents when earlier selections had left them as parser lookahead. E.g., given OneFull Next , selecting title and then #hit now advances the partial lookahead and returns Full , rather than returning an empty before its content is parsed. The updated readiness tracking follows StreamParser's normal emission order across implicit HTML structure and parser recovery. + Improvement: Improved XML parser performance and memory use for documents with many nested namespace declarations by recording namespace changes within each element scope (bsc#1275912, CVE-2026-75140). + Improvement: Improved W3CDom conversion performance for documents with many nested namespace declarations. The W3C converter now uses the same optimized namespace tracking as the XML parser. + Improvement: Improved W3CDom XML conversion to retain processing instructions, comments outside the root element, and CDATA sections, which were previously dropped or converted to text. + Improvement: DOM mutati

Announced 29 Sept 2026Source revision 1

Original source ↗

SUSE-SU-2026:4393-1

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:SUSE-SU-2026:4393-1

jsoup

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/1/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/2/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/3/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/4/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/5/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/6/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/7/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/7/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/8/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/8/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/9/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/9/ranges
Prerequisites: Not stated in this record

jsoup

Source reference: /affected/10/package/name

Affected versions: Not stated in this record
Fixed versions: 1.23.2-150200.3.14.1
Source reference: /affected/10/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7",
      "ecosystem": "SUSE:Linux Enterprise Module for Development Tools 15 SP7"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS",
      "ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS",
      "ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS",
      "ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS",
      "ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS",
      "ecosystem": "SUSE:Linux Enterprise Server 15 SP4-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS",
      "ecosystem": "SUSE:Linux Enterprise Server 15 SP5-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS",
      "ecosystem": "SUSE:Linux Enterprise Server 15 SP6-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4",
      "ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP4"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5",
      "ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP5"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.23.2-150200.3.14.1"
          }
        ]
      }
    ],
    "package": {
      "name": "jsoup",
      "purl": "pkg:rpm/suse/jsoup&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6",
      "ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP6"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4393-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "jsoup": "1.23.2-150200.3.14.1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #37635 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 10:16:43 GMT
Publisher date: Tue, 29 Sep 2026 11:50:58 GMT

Read the original announcement