org.jsoup:jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers do.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the XmlTreeBuilder namespace scope tracking in src/main/java/org/jsoup/parser/XmlTreeBuilder.java. An attacker can exhaust JVM heap memory and terminate the application by supplying a deeply nested XML document with uniquely named namespace declarations. The parser copies the inherited namespace map on each start element, so parsing documents with many nested namespace bindings grows quadratically in time and retained memory. This can trigger an OutOfMemoryError in applications that accept untrusted XML input.
Remediation
Upgrade org.jsoup:jsoup to version 1.23.2 or higher.