CVE-2021-42575: 
Java vulnerability analysis and mitigation

The OWASP Java HTML Sanitizer before version 20211018.1 contains a security vulnerability related to policy enforcement. The vulnerability was discovered and disclosed in October 2021, affecting the core sanitization functionality of the library. The issue specifically impacts how policies are enforced for SELECT, STYLE, and OPTION HTML elements (NVD Database, CVE Database).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges or user interaction, and can result in high impacts to confidentiality, integrity, and availability (NVD Database).

The vulnerability could potentially allow attackers to bypass the HTML sanitization policies specifically for SELECT, STYLE, and OPTION elements. This could lead to various security issues including potential cross-site scripting (XSS) attacks when the sanitizer is used to clean user-provided HTML content (NVD Database).

Users should upgrade to OWASP Java HTML Sanitizer version 20211018.1 or later to address this vulnerability. Oracle has also released patches for affected products in their January 2022 and July 2022 Critical Patch Updates (Oracle Jan 2022, Oracle Jul 2022).