CVE-2026-75140 jsoup: Memory exhaustion in XmlTreeBuilder via deeply nested namespace declarations (1.23.1 -> 1.23.2)

[dependabot]

Bumps org.jsoup:jsoup from 1.23.1 to 1.23.2 in openam-documentation/openam-doc-services-ref/pom.xml, clearing Dependabot alert #359. This follows #1105, which took the same dependency from 1.21.2 to 1.23.1 for CVE-2026-71497.

Advisory

CVE-2026-75140 / GHSA-65r4-943x-97jj (fixed in 1.23.2) — Allocation of resources without limits or throttling (CWE-770) in XmlTreeBuilder. The XML builder copied the entire inherited namespace map on every start tag, so a deeply nested document whose elements each declare a new namespace costs quadratic time and memory and can end in OutOfMemoryError. The fix (jhy/jsoup#2556) keeps one current bindings map, records only the bindings each element changes and restores them when it closes, which makes namespace tracking linear.

	Severity	Affected	Fixed in
GHSA-65r4-943x-97jj	High — CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)	< 1.23.2	1.23.2

Availability-only: no code execution, no data exposure.

Impact on OpenAM

None at runtime, none in practice in the build. jsoup is a dependency of openam-doc-services-ref only — no other module declares it, and it is not in the WAR. That module is the services reference generator: exec-maven-plugin runs org.openidentityplatform.openam.docs.services.Generator at prepare-package against the freshly built openam-server-only/target/OpenAM-ServerOnly-<version>, and the module jar carries only the generated .adoc files that openam-doc-source unpacks.

The only jsoup call is Jsoup.parse(html) in HtmlConverter, which turns the <i18nKey>.help / <i18nKey>.help.txt strings from OpenAM's own resource bundles into AsciiDoc. That is the HTML parser; XmlTreeBuilder (Parser.xmlParser()) is never used, and the input is repository content, not outside data. The bump takes the build tool out of the vulnerable range.

Change

openam-documentation/openam-doc-services-ref/pom.xml: org.jsoup:jsoup 1.23.1 → 1.23.2. No code change.

Behaviour changes in 1.23.2 that touch the parser HtmlConverter uses: the HTML and XML parsers now share a maximum stack depth of 512 (Parser#setMaxDepth(int)), and comments after </body> / </html> are placed as the HTML specification says. No .help / .help.txt string contains an HTML comment and their markup is only a few levels deep, so the generated reference does not change. The rest of the release (W3C DOM conversion, XML serialization, the HTTP client, StreamParser) is outside this module's code path.

References

• GHSA-65r4-943x-97jj
• https://nvd.nist.gov/vuln/detail/CVE-2026-75140
• Optimize XML namespace scope tracking jhy/jsoup#2556
• https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2