I has happened to me using a well establish Java Lib from OWASP(AntiSamy), which no one wanted to maintain, so I had to swap off to another(Java HTML Sanitizer).