Amazon Linux 2023 Security Advisory: ALAS2023-2026-2150
Advisory Released Date: 2026-09-14
Advisory Updated Date: 2026-09-14
Severity:
Medium
Issue Overview:
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1. (CVE-2026-71497)
Affected Packages:
jsoup
Issue Correction:
Run dnf update jsoup --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2150 --releasever 2023.12.20260914 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
noarch:
jsoup-1.23.2-1.amzn2023.0.1.noarch
src:
jsoup-1.23.2-1.amzn2023.0.1.src