Apache JClouds affected by XML entity expansion vulnerability (CVE-2026-119724)
Original title: CVE-2026-119724: Apache JClouds: XML External Entity (XXE) in provider-response parsing
Apache JClouds all versions vulnerable to XML entity expansion but project retired with no fix planned.
Apache JClouds is affected by an improper restriction of recursive entity references in DTDs vulnerability (CVE-2026-119724). All versions are impacted. The project is retired and no fix will be released. Users are recommended to find an alternative or restrict access.
- Affects all versions of Apache JClouds
- Project retired, no patch planned
- Severity moderate
- XXE in provider-response parsing
Impact: XML entity expansion
- 1.find an alternative
- 2.restrict access
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119724 | XML Entity Expansion in Retired Apache JClouds | 7.5 | — |
From the original article
Posted by Arnout Engelen on Nov 02 Severity: moderate Affected versions: - Apache JClouds: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.