Apache jclouds CVE-2026-119724

Requires an application that still uses Apache jclouds and parses XML responses from a cloud provider, AND an attacker able to supply or influence that XML (a malicious/compromised provider endpoint, a man-in-the-middle on the provider connection, or the application being directed at an attacker-controlled service) so that attacker-chosen DTD entity definitions reach the parser. Limiting factors: jclouds is a retired, unsupported library with no fix, so exploitability depends entirely on an organization continuing to run it; the attacker must occupy the provider-response channel rather than hit an exposed listener directly, which narrows this toward targeted rather than opportunistic exploitation. The exact parser configuration and whether DTD processing is enabled by default are not described in the available sources.

This is a moderate-severity, availability-oriented issue whose real-world priority is low-to-moderate rather than urgent. No CVSS vector, EPSS score, KEV listing, or verified PoC is supplied, and the vuln.today decision label is 'awaiting_data' - so there is no quantitative exploitation signal to weigh; urgency cannot be elevated on the data provided. The weakness is improper restriction of recursive entity references in DTDs (XML entity expansion / 'billion laughs'), which points to a denial-of-service impact against the parsing application rather than code execution or data theft. A notable conflict exists in the source data: the advisory title labels this 'XML External Entity (XXE)', which would imply possible file disclosure or SSRF (confidentiality impact), while the formal weakness description is entity expansion, which implies availability-only impact - this should be verified against the oss-security post before assuming confidentiality exposure. The dominant risk-shaping factor is not technical but lifecycle: jclouds was retired in June 2025 and moved to the Apache Attic in August 2025, the project is explicitly UNSUPPORTED, all versions are affected, and the maintainer states no fix will be released. Because exploitation requires the victim application to parse attacker-influenced XML from a cloud-provider response, this is more plausibly a targeted/trust-boundary scenario than opportunistic mass exploitation. Overall: a genuine but non-emergency issue whose chief concern is that it is permanently unpatched.

An application still built on Apache jclouds parses XML responses returned from a cloud-provider endpoint. An attacker who can influence those responses - via a malicious or compromised provider endpoint, a man-in-the-middle position, or by inducing the application to point at an attacker-controlled service - returns XML containing deeply nested recursive DTD entity definitions, causing the parser to consume excessive memory and CPU and denying service. No public exploit was identified at time of analysis.