jsoup - Debian Package Tracker

general

source: jsoup (main)
version: 1.15.3-1
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Torsten Werner [DMD] – Mechtilde Stehmann [DMD] – Jakub Adam [DMD] – Emmanuel Bourg [DMD]
arch: all
std-ver: 4.6.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.10.2-2
oldstable: 1.15.3-1
stable: 1.15.3-1
testing: 1.15.3-1
unstable: 1.15.3-1

versioned links

1.10.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.15.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjsoup-java
libjsoup-java-doc

action needed

A new upstream version is available: 1.23.1 high

A new upstream version 1.23.1 is available, you should consider packaging it.

Created: 2025-11-27 Last update: 2026-08-10 10:03

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-71497: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

Created: 2026-08-07 Last update: 2026-08-08 18:30

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-71497: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

Created: 2026-08-07 Last update: 2026-08-08 18:30

3 security issues in bullseye high

There are 3 open security issues in bullseye.

1 important issue:

CVE-2026-71497: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

2 issues postponed or untriaged:

CVE-2021-37714: (needs triaging) jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
CVE-2022-36033: (needs triaging) jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)

Created: 2026-08-07 Last update: 2026-08-08 18:30

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-71497: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

Created: 2026-08-07 Last update: 2026-08-08 18:30

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

libjsoup-java could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2026-08-10 06:00

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 36844ed30abaf6f8ff52fa85c274a6277890ec54
Merge: 6da4710 50ee278
Author: Alexandre Detiste <alexandre.detiste@gmail.com>
Date:   Fri Sep 5 11:29:07 2025 +0200

    Merge branch 'multiarch-fixes' into 'master'
    
    Apply multi-arch hints
    
    See merge request java-team/jsoup!1

commit 50ee2789e775630a30a5df9dc385097aa2fdf10a
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Jan 19 02:16:10 2023 +0000

    Apply multi-arch hints.
    + libjsoup-java: Add Multi-Arch: foreign.
    
    Changes-By: apply-multiarch-hints

https://salsa.debian.org/api/v4/projects/java-team%2Fjsoup API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2025-09-05 Last update: 2026-08-07 01:01

lintian reports 14 warnings normal

Lintian reports 14 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-10-23 Last update: 2025-09-11 00:03

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-71497: (needs triaging) jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-08-07 Last update: 2026-08-08 18:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.1).

Created: 2022-12-17 Last update: 2026-03-31 15:01

news

[rss feed]

[2022-09-05] jsoup 1.15.3-1 MIGRATED to testing (Debian testing watch)
[2022-09-04] Accepted jsoup 1.15.3-1 (source) into unstable (Markus Koschany)
[2022-08-28] jsoup 1.15.2-1 MIGRATED to testing (Debian testing watch)
[2022-08-23] Accepted jsoup 1.15.2-1 (source) into unstable (Markus Koschany)
[2022-05-29] jsoup 1.15.1-1 MIGRATED to testing (Debian testing watch)
[2022-05-23] Accepted jsoup 1.15.1-1 (source) into unstable (Markus Koschany)
[2022-01-11] Accepted jsoup 1.14.3-1~bpo11+1 (source all) into bullseye-backports, bullseye-backports (Debian FTP Masters) (signed by: Markus Koschany)
[2021-10-17] jsoup 1.14.3-1 MIGRATED to testing (Debian testing watch)
[2021-10-11] Accepted jsoup 1.14.3-1 (source) into unstable (Markus Koschany)
[2021-09-14] jsoup 1.14.2-1 MIGRATED to testing (Debian testing watch)
[2021-09-09] Accepted jsoup 1.14.2-1 (source) into unstable (Markus Koschany)
[2021-05-02] Accepted jsoup 1.13.1-1 (source) into experimental (Markus Koschany)
[2020-01-26] Accepted jsoup 1.8.1-1+deb8u1 (source all) into oldoldstable (Thorsten Alteholz)
[2018-04-20] jsoup 1.10.2-2 MIGRATED to testing (Debian testing watch)
[2018-04-14] Accepted jsoup 1.10.2-2 (source) into unstable (Markus Koschany)
[2017-01-16] jsoup 1.10.2-1 MIGRATED to testing (Debian testing watch)
[2017-01-06] Accepted jsoup 1.10.2-1 (source all) into unstable (Emmanuel Bourg)
[2016-11-04] jsoup 1.10.1-1 MIGRATED to testing (Debian testing watch)
[2016-10-29] Accepted jsoup 1.10.1-1 (source all) into unstable (Emmanuel Bourg)
[2016-05-27] jsoup 1.9.2-1 MIGRATED to testing (Debian testing watch)
[2016-05-20] Accepted jsoup 1.9.2-1 (source all) into unstable (Emmanuel Bourg)
[2016-04-23] jsoup 1.9.1-1 MIGRATED to testing (Debian testing watch)
[2016-04-17] Accepted jsoup 1.9.1-1 (source all) into unstable (Emmanuel Bourg)
[2015-09-04] jsoup 1.8.3-1 MIGRATED to testing (Britney)
[2015-08-29] Accepted jsoup 1.8.3-1 (source all) into unstable (Emmanuel Bourg)
[2015-05-05] jsoup 1.8.2-1 MIGRATED to testing (Britney)
[2015-04-29] Accepted jsoup 1.8.2-1 (source all) into unstable (Emmanuel Bourg)
[2014-10-31] jsoup 1.8.1-1 MIGRATED to testing (Britney)
[2014-10-21] Accepted jsoup 1.8.1-1 (source all) into unstable (Emmanuel Bourg)
[2013-12-01] jsoup 1.7.3-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 14)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.15.3-1build1