1.23.2 Release?

[fdevans]

Hi. Our Security team noticed the recent CVE and I'm wondering if there is a timeline for 1.23.2 release that I can share with them? I saw that the PR was already merged in that milestone.

[jhy]

Hi @fdevans,

It's out now!

https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2
https://jsoup.org/news/release-1.23.2

I would note that CVE-2026-75140 was lodged by a third-party CNA, not jsoup, and I disagree with the report. jsoup is a library, not a framework, and as such implementors need to manage thread lifecycles themselves. In my testing when working on #2556 with an adversarial payload, a simple try / catch on parser threads (which any standard concurrency framework will implement) was suitable to catch allocation failures and to allow other threads to make consistent progress.

At any rate I do encourage folks to upgrade as there are many good improvements in the release.

Thanks for being a jsoup user.

[fdevans]

Good to know! Thank you.