~ / search / GHSA-mw3r-pfmg-xp92

GHSA-mw3r-pfmg-xp92

Improper Restriction of Recursive Entity References in Apache XMLBeans

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23926

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.xmlbeans:xmlbeans < 3.0.0 3.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

References

External links from the advisory. They lead to third-party sites.