Apache Abdera XXE in Atom parsing (CVE-2026-113582)
All Apache Abdera versions are affected and unsupported; CVSS 4.0 is 8.7 with high confidentiality impact.
46
Vulnerability1 · 1 read
CVE-2026-113582
XXE in retired Apache Abdera when parsing untrusted XML
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Abdera improperly restricts XML external entity references. A remote attacker who can supply XML that an application parses with Abdera, or through its JDBC adapter paths, needs no account and no user interaction. The attacker can read sensitive data or cause the server to make requests. Every Abdera version is affected; the project is retired. Downstream products that still ship Abdera may also be exposed.
What to do: Migrate off Apache Abdera; no fixed release is planned. If you cannot migrate, keep untrusted XML away from the Abdera parser and JDBC adapter parsing paths.
| Product | Affected |
|---|---|
| Apache Abdera | all versions |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Weakness
- CWE-611
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X