Apache Abdera XXE in Atom parsing (CVE-2026-113582)
Original title: CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing
All Apache Abdera versions are affected and unsupported; CVSS 4.0 is 8.7 with high confidentiality impact.
Piotr Karwasz reported CVE-2026-113582 in Apache Abdera on October 22. Improper restriction of XML external entity references in Atom document parsing affects all versions, including builds at or after commit cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2. The issue was unsupported when assigned and is rated important, with CVSS 4.0 8.7 and CVSS 3.1 7.5. The snippet cuts off before describing the full attack outcome.
Unconfirmed: The feed snippet ends before stating what data an attacker can read.
- Severity is important; no privileges or user interaction are required.
- CVSS 4.0 vector rates confidentiality high and integrity and availability none.
- CVSS 3.1 is 7.5 with high confidentiality impact.
- No fixed version is stated.
Impact: XML external entity expansion during Atom parsing
| Product | Affected |
|---|---|
| Apache Abdera | all versions |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113582 | XXE in retired Apache Abdera when parsing untrusted XML | 8.7 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2 | all versions - Apache Abdera: all versions - Apache Abdera cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2 or later Description: UNSUPPORTED WHEN ASSIGNED Improper re |
From the original article
Posted by Piotr Karwasz on Oct 22 Severity: important CVSS 4. 0: 8. 7 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.