StackRadar

CVE-2026-75140

High

Advisory

Published 20 Aug 2026In the index since 6 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
157
of 18,026 indexed, latest versions
Container images
158
deployed by those charts
Fix available
1 of 1
affected package

jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations

Carried by container images the latest versions of 157 of 18,026 indexed charts deploy, on 158 images.

Affected packageAffected versionsFixed inImages
jsoupmaven1.6.1, 1.7.1, 1.7.2, 1.8.1+26 more1.23.2158
OSV records
GHSA-65r4-943x-97jj

Charts affected

157 by stars
ChartLatestAffected imagesRadar Score
blackduck-alertblackduck8.4.11 of 4See more

blackduck-alert blackduck 8.4.1

1 of the 4 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
blackducksoftware/blackduck-alert:8.4.1b66c8385ba53
jsoup@1.15.4
1.23.2

Open the chart page →

1,918
bluerange-serverbluerangeOfficialVerified publisher1.4.01 of 1See more

bluerange-server bluerange 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
bluerange/bluerange:26.2.0503577ef9143
jsoup@1.20.1
1.23.2

Open the chart page →

1,987
opensearch-singlenodecaptnbpVerified publisher1.0.91 of 2See more

opensearch-singlenode captnbp 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.15.01963b3ece46d
jsoup@1.15.3
1.23.2

Open the chart page →

1,366
metabasecasemark2.16.111 of 1See more

metabase casemark 2.16.11

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
jsoup@1.17.2
1.23.2

Open the chart page →

1,526
riemanncloudnativeapp0.1.21 of 1See more

riemann cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
raykrueger/riemann:0.2.14c8baf3de57bb
jsoup@1.6.1
1.23.2

Open the chart page →

8,000
opencloudcommunity-opencloud3.1.01 of 13See more

opencloud community-opencloud 3.1.0

1 of the 13 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
apache/tika:latest-full80072bb73dd3
jsoup@1.23.1
1.23.2

Open the chart page →

10,569
damap-chartdamapVerified publisher0.3.11 of 5See more

damap-chart damap 0.3.1

1 of the 5 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
ghcr.io/damap-org/damap-backend:5.0.10d5166b01eec
jsoup@1.21.2
1.23.2

Open the chart page →

16,501
metabasedasmeta0.1.01 of 1See more

metabase dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
metabase/metabase:v0.63.1.124f150effd484
jsoup@1.21.2
1.23.2

Open the chart page →

944
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
jsoup@1.12.1
1.23.2

Open the chart page →

9,401
db2restdb2rest0.2.01 of 1See more

db2rest db2rest 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
kdhrubo/db2rest:lateste20610ff81b0
jsoup@1.15.3
1.23.2

Open the chart page →

1,077
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
epam/ai-dial-admin-backend:0.21.08b91130e3731
jsoup@1.23.1
1.23.2

Open the chart page →

4,169
mintakaeclipse-aeriosVerified publisher1.0.01 of 2See more

mintaka eclipse-aerios 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
fiware/mintaka:0.7.092a3c5cf43c0
jsoup@1.12.1
1.23.2

Open the chart page →

12,731
eoloPlanteolo-plannerVerified publisher0.1.01 of 7See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
jsoup@1.12.1
1.23.2

Open the chart page →

30,507
eoloplannereoloplannerVerified publisher0.1.01 of 7See more

eoloplanner eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
jsoup@1.12.1
1.23.2

Open the chart page →

36,758
eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher0.1.01 of 7See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
jsoup@1.12.1
1.23.2

Open the chart page →

30,523
eoloplannereoloplanner-molynx-gat0.1.01 of 7See more

eoloplanner eoloplanner-molynx-gat 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
molynx/planner:v1441c9f52f092
jsoup@1.12.1
1.23.2

Open the chart page →

33,086
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
arturisimo/planner:v1.0fff9de644941
jsoup@1.12.1
1.23.2

Open the chart page →

32,566
eoloplanteoloplant1.0.01 of 7See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
jsoup@1.12.1
1.23.2

Open the chart page →

30,523
eoloplantseoloplants-urjcVerified publisher0.1.01 of 7See more

eoloplants eoloplants-urjc 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
lourdesmorente/new-planner:1.0.0608745878cdb
jsoup@1.12.1
1.23.2

Open the chart page →

32,306
servereoloserverVerified publisher0.1.01 of 7See more

server eoloserver 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
jsoup@1.12.1
1.23.2

Open the chart page →

36,758
gerrit-operatorepmdedpVerified publisher2.25.01 of 2See more

gerrit-operator epmdedp 2.25.0

1 of the 2 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
epamedp/edp-gerrit:3.14.249e8fe9c4855
jsoup@1.14.3
1.23.2

Open the chart page →

1,421
fddb-exporterfddb-exporterVerified publisher2.4.31 of 1See more

fddb-exporter fddb-exporter 2.4.3

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
ghcr.io/itobey/fddb-exporter:2.4.1a824933e0f87
jsoup@1.23.1
1.23.2

Open the chart page →

632
apollofiware0.1.41 of 1See more

apollo fiware 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
quay.io/fiware/apollo:0.0.1055330b1b60c1
jsoup@1.12.1
1.23.2

Open the chart page →

7,194
canis-majorfiware0.2.31 of 1See more

canis-major fiware 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
quay.io/fiware/canis-major:1.5.15bb40472e4ff5
jsoup@1.12.1
1.23.2

Open the chart page →

8,776
dss-validation-servicefiware0.0.191 of 1See more

dss-validation-service fiware 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jsoup@1.12.1
1.23.2

Open the chart page →

4,805
endpoint-auth-servicefiware0.1.41 of 4See more

endpoint-auth-service fiware 0.1.4

1 of the 4 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
quay.io/fiware/endpoint-configuration-service:0.4.30dc38a87b844
jsoup@1.12.1
1.23.2

Open the chart page →

14,141
mintakafiware0.4.71 of 1See more

mintaka fiware 0.4.7

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
fiware/mintaka:latestefc6793388cc
jsoup@1.12.1
1.23.2

Open the chart page →

7,261
trusted-issuers-registryfiware0.13.01 of 1See more

trusted-issuers-registry fiware 0.13.0

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
quay.io/fiware/trusted-issuers-registry:0.11.1a8a9ec461034
jsoup@1.12.1
1.23.2

Open the chart page →

7,364
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
jsoup@1.11.3
1.23.2

Open the chart page →

18,970
komgageek-cookbookVerified publisher2.4.21 of 1See more

komga geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
gotson/komga:0.99.49b15ea6bfc30
jsoup@1.13.1
1.23.2

Open the chart page →

12,963
nzbhydra2geek-cookbookVerified publisher10.4.21 of 1See more

nzbhydra2 geek-cookbook 10.4.2

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
jsoup@1.11.3
1.23.2

Open the chart page →

19,223
pretend-youre-xyzzygeek-cookbookVerified publisher3.4.21 of 1See more

pretend-youre-xyzzy geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
emcniece/dockeryourxyzzy:404eccbccc15c
jsoup@1.11.2
1.23.2

Open the chart page →

595
teedygeek-cookbookVerified publisher6.2.01 of 1See more

teedy geek-cookbook 6.2.0

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
sismics/docs:v1.10f4b0ef019cf1
jsoup@1.13.1
1.23.2

Open the chart page →

27,818
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
jingking/geonetwork-hnap:4.2.843e74ab234e1
jsoup@1.15.3
1.23.2

Open the chart page →

37,657
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
jsoup@1.15.3
1.23.2

Open the chart page →

56,631
cc-spring-appgridgainVerified publisher1.0.61 of 1See more

cc-spring-app gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
gridgain/cloud-connector:2025.5.15ab838d7d3cb
jsoup@1.21.2
1.23.2

Open the chart page →

1,917
gridgain9gridgainVerified publisher1.1.101 of 2See more

gridgain9 gridgain 1.1.10

1 of the 2 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
gridgain/gridgain9:9.1.1895018390077b
jsoup@1.16.1
1.23.2

Open the chart page →

3,822
ubooquityhalkeye0.1.11 of 1See more

ubooquity halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
linuxserver/ubooquity:2.1.2-ls369932d6759112
jsoup@1.8.3
1.23.2

Open the chart page →

4,358
booklorehelmforgeVerified publisher2.0.21 of 3See more

booklore helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
jsoup@1.22.2
1.23.2

Open the chart page →

2,382
elasticsearchhelmforgeVerified publisher1.1.81 of 2See more

elasticsearch helmforge 1.1.8

1 of the 2 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.3a4e2b3d21ad0
jsoup@1.21.2
1.23.2

Open the chart page →

446
kibanahelmforgeVerified publisher1.1.81 of 3See more

kibana helmforge 1.1.8

1 of the 3 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.19656a9ca03f8
jsoup@1.21.2
1.23.2

Open the chart page →

565
komgahelmforgeVerified publisher1.4.161 of 1See more

komga helmforge 1.4.16

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
gotson/komga:1.27.19cf102f5fb78
jsoup@1.23.1
1.23.2

Open the chart page →

35,970
webodmhelmforgeVerified publisher1.0.01 of 4See more

webodm helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
opendronemap/nodeodm:3.6.2fcd99eb23d8d
jsoup@1.8.1
1.23.2

Open the chart page →

22,394
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.3.2798cf28e226a
jsoup@1.15.3
1.23.2

Open the chart page →

25,785
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
apache/tika:3.3.1.090b7fa1dc018
jsoup@1.22.2
1.23.2

Open the chart page →

31,703
eoloplanthttpd-eoloplant0.1.01 of 7See more

eoloplant httpd-eoloplant 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
jsoup@1.12.1
1.23.2

Open the chart page →

36,758
nexus3huangchengwu-helm-chart0.1.01 of 1See more

nexus3 huangchengwu-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
sonatype/nexus3:3.53.04bd975493104
jsoup@1.15.3
1.23.2

Open the chart page →

4,718
ibm-microclimateibm-charts0.1.03 of 8See more

ibm-microclimate ibm-charts 0.1.0

3 of the 8 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
jsoup@1.7.2
1.23.2
ibmcom/microclimate-portal:latested5505e5c7ec
jsoup@1.10.3
1.23.2
ibmcom/microclimate-theia:lateste17bdccc5030
jsoup@1.9.2
1.23.2

Open the chart page →

119,072
eoloserverihuertas2021-vmartinp2021-helm0.1.01 of 7See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
huertaslopez/i.huertas.2021-v.martinp.2021-planner:2.0.0e2c18bd65472
jsoup@1.12.1
1.23.2

Open the chart page →

32,306
jenainseefrlab3.1.01 of 1See more

jena inseefrlab 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-75140.

Container imageDigestPackageFixed in
stain/jena-fuseki:latestb1d0c96f19ad
jsoup@1.17.2
1.23.2

Open the chart page →

1,288

Container images carrying it

158 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/fiware/apollo:0.0.1055330b1b60c1
jsoup@1.12.1
1.23.2
1
quay.io/fiware/canis-major:1.5.15bb40472e4ff5
jsoup@1.12.1
1.23.2
1
quay.io/fiware/endpoint-configuration-service:0.4.30dc38a87b844
jsoup@1.12.1
1.23.2
1
quay.io/fiware/trusted-issuers-registry:0.11.1a8a9ec461034
jsoup@1.12.1
1.23.2
1
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
jsoup@1.8.3
1.23.2
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
jsoup@1.12.1
1.23.2
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
jsoup@1.12.1
1.23.2
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jsoup@1.12.1
1.23.2
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.