The vulnerability in jsoup allows remote attackers to feed a deeply nested XML document containing uniquely‑namespaced elements to XmlTreeBuilder. The parser repeatedly copies the inherited namespace map for each start element, resulting in quadratic time and memory usage. This excessive consumption can exhaust JVM heap memory, causing an OutOfMemoryError that terminates the application, effectively creating a denial‑of‑service condition. The weaknesses correspond to CWE‑770: Uncontrolled Resource Consumption and CWE‑1050.

The flaw affects the jsoup library version 1.23.2 and earlier. Any application that parses untrusted XML input using these jsoup releases is potentially vulnerable; the vendor notation is jhy:soup.

The CVSS score of 8.7 signifies high severity, and with an EPSS score of 0.00525 (0.525%), the lack of an assigned KEV tag suggests no known public exploitation yet. The vulnerability can be triggered remotely by submitting a carefully crafted XML payload. Circumventing the quadratic behavior depends solely on supplying a deeply nested, uniquely‑namespaced structure; no additional privileges or precondition beyond input are required.