Hi,

The following vulnerability was published for jsoup.

Note I'm making this RC leve as we have the same version present in
bookworm, trixie, forky and sid. For forky this should thus be
defintively RC to make sure we move to a newer upstream version?

CVE-2026-71497[0]:
| jsoup is a Java library for working with real-world HTML. From
| 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a
| malformed tag name ending in a control character, causing the tag to
| acquire the parsing behavior of a different element. When a custom
| Safelist permits certain raw-text elements, this misparsing can
| cause content that should remain inert text to be emitted as active
| markup after serialization, potentially resulting in cross-site
| scripting. jsoup's built-in Safelists are not affected. This issue
| is fixed in version 1.23.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-71497
https://www.cve.org/CVERecord?id=CVE-2026-71497
[1] https://github.com/jhy/jsoup/issues/2538
[2] https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8
[4] https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70

Regards,
Salvatore