CVE-2021-42575

Policies not properly enforced in OWASP Java HTML Sanitizer

9.8 CriticalFix available

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.97%Up 2.6 points since Oct 19, 2021

What each source reports

NVD Score used 9.8

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Record: CVE-2021-42575
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Record: CVE-2021-42575
Updated: 2026-11-02

EUVDEUVD-2021-2151 No score

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Record: EUVD-2021-2151
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3w73-fmf3-hg5c 9.8

Policies not properly enforced in OWASP Java HTML Sanitizer

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Record: GHSA-3w73-fmf3-hg5c
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSVGHSA-3w73-fmf3-hg5c 9.8

Policies not properly enforced in OWASP Java HTML Sanitizer

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Record: GHSA-3w73-fmf3-hg5c
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSVRHSA-2022:7409 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7

Record: RHSA-2022:7409
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7410 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8

Record: RHSA-2022:7410
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7411 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9

Record: RHSA-2022:7411
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer` Maven	before 20211018.1	20211018.1
`com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer` Maven	before 20211018.1, plus listed versions 1.120150501.120151202.220160203.120160413.1 Show 30 moreShow less 20160422.120160526.120160614.120160628.120160827.120160924.120170329.120170408.120170411.120170512.120170515.120171016.120180219.120181114.120190325.120190503.120190610.120191001.120200615.120200713.1r136r156r163r164r173r198r209r223r232r239	20211018.1
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el7sso	0:18.0.3-1.redhat_00001.1.el7sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el7sso	0:18.0.3-1.redhat_00001.1.el7sso
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el8sso	0:18.0.3-1.redhat_00001.1.el8sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el8sso	0:18.0.3-1.redhat_00001.1.el8sso
`rh-sso7` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:1-5.el9sso	0:1-5.el9sso
`rh-sso7-javapackages-filesystem` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:6.0.0-7.el9sso	0:6.0.0-7.el9sso
`rh-sso7-javapackages-tools` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:6.0.0-7.el9sso	0:6.0.0-7.el9sso
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el9sso	0:18.0.3-1.redhat_00001.1.el9sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el9sso	0:18.0.3-1.redhat_00001.1.el9sso
`rh-sso7-python3-javapackages` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:6.0.0-7.el9sso	0:6.0.0-7.el9sso
`rh-sso7-runtime` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:1-5.el9sso	0:1-5.el9sso

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-42575 is a critical vulnerability (CVSS 9.8) in Owasp Java Html Sanitizer, published October 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.97%, the 87th percentile. Fixed in com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 20211018.1.

References

Show 56 moreShow less