CVE-2023-34623
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other...
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
- Record
CVE-2023-34623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
- Record
CVE-2023-34623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2023-38668
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
- Record
EUVD-2023-38668- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fv2r-hw24-8rxj
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other...
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
- Record
GHSA-fv2r-hw24-8rxj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
- Record
CVE-2023-34623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-34623
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
- Record
DEBIAN-CVE-2023-34623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVOESA-2026-1657
jtidy security update
JTidy is the Java port for HTML Tidy, which is an HTML syntax checker and a nice printer. JTidy can be used as a tool to clean up misformatted HTML. In addition, JTidy provides a DOM interface to the documents being processed, effectively enabling you to use JTidy as a DOM parser for real HTML.
Security Fix(es):
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.(CVE-2023-34623)
- Record
OESA-2026-1657- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-34623
An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
- Record
UBUNTU-CVE-2023-34623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13152-1 No score
jtidy-1.0.4-1.1 on GA media
These are all security issues fixed in the jtidy-1.0.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13152-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3016-1 No score
Security update for jtidy
This update for jtidy fixes the following issues:
- CVE-2023-34623: Prevent crash when parsing documents with excessive nesting (bsc#1212404).
- Record
SUSE-SU-2023:3016-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3164-1 No score
Security update for jtidy
This update for jtidy fixes the following issues:
- CVE-2023-34623: Prevent crash when parsing documents with excessive nesting (bsc#1212404).
- Record
SUSE-SU-2023:3164-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3165-1 No score
Security update for jtidy
This update for jtidy fixes the following issues:
- CVE-2023-34623: Fixed crash when parsing documents with excessive nesting (bsc#1212404).
- Record
SUSE-SU-2023:3165-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jtidyDebian:12 |
All versions, plus listed versions 7+svn20110807-57+svn20110807-6 |
None known |
jtidyDebian:13 |
All versions, plus listed versions 7+svn20110807-6 |
None known |
jtidyDebian:14 |
All versions, plus listed versions 7+svn20110807-6 |
None known |
jtidyopenEuler:24.03-LTS |
before 1.0-0.30.20100930svn1125.oe2403sp3 | 1.0-0.30.20100930svn1125.oe2403sp3 |
jtidyopenEuler:24.03-LTS-SP1 |
before 1.0-0.30.20100930svn1125.oe2403sp1 | 1.0-0.30.20100930svn1125.oe2403sp1 |
jtidyopenEuler:24.03-LTS-SP2 |
before 1.0-0.30.20100930svn1125.oe2403sp2 | 1.0-0.30.20100930svn1125.oe2403sp2 |
jtidyopenEuler:24.03-LTS-SP3 |
before 1.0-0.30.20100930svn1125.oe2403sp3 | 1.0-0.30.20100930svn1125.oe2403sp3 |
jtidyopenEuler:20.03-LTS-SP4 |
before 1.0-0.30.20100930svn1125.oe2003sp4 | 1.0-0.30.20100930svn1125.oe2003sp4 |
jtidyopenEuler:22.03-LTS-SP4 |
before 1.0-0.30.20100930svn1125.oe2203sp4 | 1.0-0.30.20100930svn1125.oe2203sp4 |
jtidySUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 8.0-150000.4.3.1 | 8.0-150000.4.3.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jtidySUSE:Linux Enterprise Server 15 SP1-LTSS |
before 8.0-150000.4.3.1 | 8.0-150000.4.3.1 |
jtidySUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 8.0-150000.4.3.1 | 8.0-150000.4.3.1 |
jtidySUSE:Linux Enterprise Module for Development Tools 15 SP4 |
before 8.0-150200.11.7.1 | 8.0-150200.11.7.1 |
jtidySUSE:Linux Enterprise Module for Development Tools 15 SP5 |
before 8.0-150200.11.7.1 | 8.0-150200.11.7.1 |
jtidySUSE:Linux Enterprise Real Time 15 SP3 |
before 8.0-150200.11.7.1 | 8.0-150200.11.7.1 |
jtidyopenSUSE:Leap 15.4 |
before 8.0-150200.11.7.1 | 8.0-150200.11.7.1 |
jtidyopenSUSE:Leap 15.5 |
before 8.0-150200.11.7.1 | 8.0-150200.11.7.1 |
jtidySUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 8.0-27.3.1 | 8.0-27.3.1 |
jtidyUbuntu:16.04:LTS |
All versions, plus listed versions 7+svn20110807-4 |
None known |
jtidyUbuntu:18.04:LTS |
All versions, plus listed versions 7+svn20110807-47+svn20110807-5 |
None known |
jtidyUbuntu:20.04:LTS |
All versions, plus listed versions 7+svn20110807-5 |
None known |
jtidyUbuntu:22.04:LTS |
All versions, plus listed versions 7+svn20110807-5 |
None known |
jtidyUbuntu:24.04:LTS |
All versions, plus listed versions 7+svn20110807-5 |
None known |
jtidyUbuntu:25.10 |
All versions, plus listed versions 7+svn20110807-6 |
None known |
jtidyUbuntu:26.10 |
All versions, plus listed versions 7+svn20110807-6build1 |
None known |
jtidyUbuntu:26.04:LTS |
All versions, plus listed versions 7+svn20110807-67+svn20110807-6build1 |
None known |
jtidyopenSUSE:Tumbleweed |
before 1.0.4-1.1 | 1.0.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34623 is a high vulnerability (CVSS 7.5) in Jtidy Project Jtidy, published June 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. Fixed in jtidy 1.0-0.30.20100930svn1125.oe2403sp3.
References
github.com/trajano/jtidy/issues/4
nvd.nist.gov/vuln/detail/CVE-2023-34623
security-tracker.debian.org/tracker/CVE-2023-34623
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1657
suse.com/support/update/announcement/2023/suse-su-20233016-1