CVE-2026-71497
MediumAdvisory
Published 6 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 4.7
- base score, highest
- EPSS
- 0.002
- 9th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 78
- of 17,781 indexed, latest versions
- Container images
- 81
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jsoup: Cleaner may expose markup with custom raw-text elements
Carried by container images the latest versions of 78 of 17,781 indexed charts deploy, on 81 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jsoupmaven | 1.14.3, 1.15.3, 1.15.4, 1.16.1+11 more | 1.23.1 | 81 |
- OSV records
- GHSA-pmhh-3w7g-xqp8
Charts affected
78 by stars
Container images carrying it
81 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| airbyte/ | 119be7bfb719 | jsoup | 1.23.1 | 2 |
| graviteeio/ | 05fd67a93056 | jsoup | 1.23.1 | 2 |
| graviteeio/ | 27374522cd04 | jsoup | 1.23.1 | 2 |
| library/ | 89729a95066a | jsoup | 1.23.1 | 2 |
| metabase/ | 9491ed11c901 | jsoup | 1.23.1 | 2 |
| opensearchproject/ | 4254021a8c71 | jsoup | 1.23.1 | 2 |
| opensearchproject/ | 7f6fa1efee8f | jsoup | 1.23.1 | 2 |
| ghcr.io/ | 536358d7b17e | jsoup | 1.23.1 | 2 |
| 1dev/ | cd5b12fe5471 | jsoup | 1.23.1 | 1 |
| airbyte/ | f71cf4e185d5 | jsoup | 1.23.1 | 1 |
| airbyte/ | d42813fcc191 | jsoup | 1.23.1 | 1 |
| airbyte/ | d97b67a1346d | jsoup | 1.23.1 | 1 |
| airbyte/ | 70e125498a1c | jsoup | 1.23.1 | 1 |
| airbyte/ | 8060b88b29c8 | jsoup | 1.23.1 | 1 |
| airbyte/ | 42093cff86e9 | jsoup | 1.23.1 | 1 |
| apache/ | 90b7fa1dc018 | jsoup | 1.23.1 | 1 |
| apache/ | ffab324253ed | jsoup | 1.23.1 | 1 |
| assistiot/ | 23f195a7a26a | jsoup | 1.23.1 | 1 |
| athou/ | 5e388351df1a | jsoup | 1.23.1 | 1 |
| atlassian/ | 05933f2b1cfd | jsoup | 1.23.1 | 1 |
| atlassian/ | c81cc7d6bc9e | jsoup | 1.23.1 | 1 |
| atlassian/ | ebf761c7d437 | jsoup | 1.23.1 | 1 |
| atlassian/ | 64a75aa4ec4e | jsoup | 1.23.1 | 1 |
| atlassian/ | e5548cd4eea8 | jsoup | 1.23.1 | 1 |
| bitnamilegacy/ | d8440eb6b290 | jsoup | 1.23.1 | 1 |
| blackducksoftware/ | 90cca32de2cc | jsoup | 1.23.1 | 1 |
| bluerange/ | 07c8f73b55df | jsoup | 1.23.1 | 1 |
| cmosborn/ | 6ec0a8878ad2 | jsoup | 1.23.1 | 1 |
| codetogether/ | 4348c8a38752 | jsoup | 1.23.1 | 1 |
| conductoross/ | 9fba127693e6 | jsoup | 1.23.1 | 1 |
| easypi/ | d2950a36a576 | jsoup | 1.23.1 | 1 |
| eginnovations/ | e4dfe242fe9f | jsoup | 1.23.1 | 1 |
| epamedp/ | 49e8fe9c4855 | jsoup | 1.23.1 | 1 |
| erudikaltd/ | 949c56b57e8f | jsoup | 1.23.1 | 1 |
| frankescobar/ | dc171ec796d5 | jsoup | 1.23.1 | 1 |
| gotson/ | ba892ab3e082 | jsoup | 1.23.1 | 1 |
| graviteeio/ | 4140932887e0 | jsoup | 1.23.1 | 1 |
| graviteeio/ | 07b7f6dc267a | jsoup | 1.23.1 | 1 |
| graviteeio/ | a8eb04ee0c70 | jsoup | 1.23.1 | 1 |
| graylog/ | 598bd41fefd5 | jsoup | 1.23.1 | 1 |
| graylog/ | 8a1f641cd7aa | jsoup | 1.23.1 | 1 |
| gridgain/ | 5ab838d7d3cb | jsoup | 1.23.1 | 1 |
| gridgain/ | 95018390077b | jsoup | 1.23.1 | 1 |
| hivemq/ | 4d194450d48e | jsoup | 1.23.1 | 1 |
| jingking/ | 43e74ab234e1 | jsoup | 1.23.1 | 1 |
| lavandadelpatio/ | 214eaef5444c | jsoup | 1.23.1 | 1 |
| library/ | 8d09295845fe | jsoup | 1.23.1 | 1 |
| library/ | 9656a9ca03f8 | jsoup | 1.23.1 | 1 |
| linuxserver/ | d286a7f55a59 | jsoup | 1.23.1 | 1 |
| liukunup/ | 9c079617a81b | jsoup | 1.23.1 | 1 |