Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
jsoup can let crafted URLs bypass checks
published 3 months ago
Summary
The jsoup library may accept URLs that contain hidden control characters, causing the URL validation to be bypassed. This can allow malicious links to be processed as safe. Update jsoup to the latest version that removes those characters from URLs.
What to do
- Update almalinux jsoup to version 1.13.1-10.el9.tuxcare.els1.
- Update almalinux jsoup-javadoc to version 1.13.1-10.el9.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | jsoup |
< 1.13.1-10.el9.tuxcare.els1 Fix: upgrade to 1.13.1-10.el9.tuxcare.els1
|
| TuxCare:AlmaLinux:9.2 | almalinux | jsoup-javadoc |
< 1.13.1-10.el9.tuxcare.els1 Fix: upgrade to 1.13.1-10.el9.tuxcare.els1
|
Original advisory text
jsoup: Fix of CVE-2022-36033
- CVE-2022-36033: strip control characters from URLs before protocol validation
References
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784880925.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-36033 Vendor Advisory
Timeline
Published24 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1784880925 · OSV
Track software like this
Free during beta