Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2021-37714

Uncaught Exception

Published: Aug 18, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
LOW
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2021-37714
CWEhttps://cwe.mitre.org/data/definitions/248.html

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Weakness

An exception is thrown from a function, but it is not caught.

Affected Software

NameVendorStart VersionEnd Version
JsoupJsoup*1.14.2 (excluding)
EAP 7.3.10 GARedHatjsoup*
Red Hat build of Quarkus 2.2.5RedHatjsoup*
Red Hat EAP-XP 2 via EAP 7.3.x baseRedHatjsoup*
Red Hat Fuse 7.10RedHatjsoup*
Red Hat JBoss Enterprise Application Platform 7RedHatjsoup*
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7RedHateap7-activemq-artemis-0:1.5.5.016-1.redhat_00001.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7RedHateap7-artemis-native-1:1.5.5.016-1.redhat_00001.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7RedHateap7-jboss-xnio-base-0:3.5.11-1.Final_redhat_00001.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7RedHateap7-jsoup-0:1.14.2-1.redhat_00002.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7RedHateap7-undertow-0:1.4.18-14.SP13_redhat_00001.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7RedHateap7-wildfly-0:7.1.10-2.GA_redhat_00002.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7RedHateap7-woodstox-core-0:5.0.3-2.redhat_00002.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7RedHateap7-xml-security-0:2.0.10-2.redhat_00002.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-apache-cxf-0:3.3.12-1.redhat_00001.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-ironjacamar-0:1.5.3-1.Final_redhat_00001.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-jakarta-el-0:3.0.3-3.redhat_00007.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-jboss-ejb-client-0:4.0.43-1.Final_redhat_00001.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-jboss-server-migration-0:1.7.2-10.Final_redhat_00011.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-jsoup-0:1.14.2-1.redhat_00002.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-resteasy-0:3.11.5-1.Final_redhat_00001.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-undertow-0:2.0.41-1.SP1_redhat_00001.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-wildfly-0:7.3.10-2.GA_redhat_00003.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-wildfly-elytron-0:1.10.15-1.Final_redhat_00001.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-wss4j-0:2.2.7-1.redhat_00001.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6RedHateap7-xml-security-0:2.1.7-1.redhat_00001.1.el6eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-apache-cxf-0:3.3.12-1.redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-ironjacamar-0:1.5.3-1.Final_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-jakarta-el-0:3.0.3-3.redhat_00007.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-jboss-ejb-client-0:4.0.43-1.Final_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-jboss-server-migration-0:1.7.2-10.Final_redhat_00011.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-jsoup-0:1.14.2-1.redhat_00002.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-resteasy-0:3.11.5-1.Final_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-undertow-0:2.0.41-1.SP1_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-wildfly-0:7.3.10-2.GA_redhat_00003.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-wildfly-elytron-0:1.10.15-1.Final_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-wss4j-0:2.2.7-1.redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7RedHateap7-xml-security-0:2.1.7-1.redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-apache-cxf-0:3.3.12-1.redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-ironjacamar-0:1.5.3-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-jakarta-el-0:3.0.3-3.redhat_00007.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-jboss-ejb-client-0:4.0.43-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-jboss-server-migration-0:1.7.2-10.Final_redhat_00011.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-jsoup-0:1.14.2-1.redhat_00002.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-resteasy-0:3.11.5-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-undertow-0:2.0.41-1.SP1_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-wildfly-0:7.3.10-2.GA_redhat_00003.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-wildfly-elytron-0:1.10.15-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-wss4j-0:2.2.7-1.redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8RedHateap7-xml-security-0:2.1.7-1.redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8RedHateap7-jsoup-0:1.14.2-1.redhat_00002.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7RedHateap7-jsoup-0:1.14.2-1.redhat_00002.1.el7eap*
Red Hat Single Sign-On 7.4.10RedHatjsoup*
RHAF Camel-K 1.8RedHatjsoup*
RHINT Camel-Q 2.7RedHat*
RHPAM 7.13.0 asyncRedHatjsoup*
JsoupUbuntubionic*
JsoupUbuntufocal*
JsoupUbuntuhirsute*
JsoupUbuntuimpish*
JsoupUbuntukinetic*
JsoupUbuntutrusty*
JsoupUbuntutrusty/esm*
JsoupUbuntuupstream*
JsoupUbuntuxenial*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use