EUVD-2026-57314
GHSA-jwq9-92hc-xq2j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable parser accepts untrusted XML with no auth required; only confidentiality impacted via file read or SSRF; no integrity or availability effect described.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.
AnalysisAI
XXE injection in Eclipse RDF4J exposes applications to local file disclosure and server-side request forgery when parsing untrusted XML-based RDF data or SPARQL query results. The root cause is an incomplete remediation of CVE-2018-1000644: while that earlier fix hardened some parser entry points, several XML parser interfaces remained unprotected against DOCTYPE declarations, external entity references, and external DTD loading. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application accepts and parses untrusted XML-based RDF data or SPARQL XML query results through one or more of RDF4J's XML parser entry points. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 reflects a fully unauthenticated, network-reachable, low-complexity path to high confidentiality impact with no subsequent-system impact (VC:H, VI:N, VA:N, SC:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted RDF/XML document - for example via a SPARQL endpoint, a data import API, or any interface that passes XML-formatted RDF to an RDF4J parser - containing a DOCTYPE declaration that defines an external entity pointing to a sensitive local file such as /etc/passwd or a cloud instance metadata URL. When RDF4J's unpatched parser entry point processes the document, it resolves the entity and includes the file contents in the parsed output or a resulting error message, which the attacker reads from the response. … |
| Remediation | The primary fix is upgrading to Eclipse RDF4J 5.3.2, which disables DOCTYPE declarations, external entity references, and external DTD loading by default across all XML parser entry points. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running vulnerable RDF4J versions and, where feasible, restrict network access to RDF parsing endpoints using firewall rules or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today