Apache JClouds affected by XML entity expansion vulnerability (CVE-2026-119724)
Apache JClouds all versions vulnerable to XML entity expansion but project retired with no fix planned.
10
CVE-2026-119724
XML Entity Expansion in Retired Apache JClouds
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache JClouds has an XML entity expansion vulnerability via improper DTD parsing in provider responses. It affects all versions of this retired project. An attacker could trigger it with untrusted XML input. No fix is planned; users should find an alternative or restrict access to trusted users only.
What to do: Find an alternative to Apache JClouds or restrict access to trusted users only.
| Product | Affected |
|---|---|
| Apache JClouds | all versions |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Weakness
- CWE-776
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N