CVE-2023-34623

What it actually does

The flaw permits an attacker-supplied object containing cyclic references to trigger uncontrolled recursion or resource exhaustion inside the JTidy HTML parser, resulting in denial of service through memory corruption.

Why it matters to the business

Services that parse untrusted HTML with JTidy can experience sudden crashes or sustained unavailability, disrupting web content processing and any dependent applications or workflows.

How an attack unfolds

An attacker crafts an HTML document or object that references itself in a cycle, then supplies it to any application using the vulnerable JTidy library; the parser enters infinite recursion, exhausting stack or heap resources and crashing the process.

How to fix it

Replace JTidy with a maintained HTML parser; if immediate replacement is impossible, wrap all JTidy invocations with strict input-size limits and cycle-detection logic before parsing.

How to confirm the fix worked

Confirm that JTidy is no longer present in the runtime classpath or that all parsing calls are guarded by size and cycle checks; re-test with cyclic payloads to verify the application no longer crashes.

Typical attack path

1. Locate an application endpoint or API that accepts HTML or XML input processed by JTidy
2. Generate a minimal payload containing cyclic object references that the parser will traverse
3. Submit the payload over the network without authentication
4. Observe resource exhaustion or process termination confirming successful denial of service

How to detect it

Review application logs for uncaught stack-overflow or out-of-memory exceptions immediately following receipt of HTML payloads; correlate with web-server access logs showing unusually large or malformed POST bodies.

What your security team should do

• Inventory all deployments that include the JTidy library and prioritize removal or replacement
• Implement input validation and resource limits around any remaining HTML parsing code
• Monitor for sudden spikes in memory or CPU usage on systems that process external HTML