Apache discloses four flaws in retired Cocoon; no fixes planned
October 20: oss-security also posted Cocoon advisories for XEE/SSRF, SQL injection, and cross-user cache poisoning, with no fixing release planned.
Apache disclosed four vulnerabilities in all versions of retired Apache Cocoon on October 20, with no fixes planned.
On October 20, 2026, Arnout Engelen posted four Apache advisories for retired Apache Cocoon, each marked unsupported when assigned and affecting every version. Moderate issues are XML entity expansion in the form processor that could enable SSRF and file disclosure (CVE-2026-108086), SQL injection through the SQL processor or sql: and esql: logicsheets (CVE-2026-108087), and unauthenticated access to diagnostic interfaces including cache triggering, verbose debug logging, and profile data (CVE-2026-108089). Low-severity CVE-2026-108088 can serve one user's cached values to others when caching is enabled on multi-user applications. Apache says it will not release a fix for the cache issue; other notices are truncated before a full remediation statement.
- All Apache Cocoon versions are affected; the project was already retired.
- CVE-2026-108086: moderate XEE in the form processor, possible SSRF and file disclosure.
- CVE-2026-108087: moderate SQL injection via the SQL processor or logicsheets.
- CVE-2026-108088: low cross-user cache poisoning; Apache will not ship a fix.
- CVE-2026-108089: moderate unauthenticated access to diagnostic interfaces.
- Arnout Engelen posted the four advisories on October 20, 2026.
Timeline
dated events in the reporting · oldest first- Oct 20, 2026XEE advisory CVE-2026-108086 posted for all Cocoon versions · oss-security
- Oct 20, 2026SQL injection CVE-2026-108087 posted; project marked unsupported · oss-security
- Oct 20, 2026Cache-poisoning CVE-2026-108088 posted; no fix planned · oss-security
- Oct 20, 2026Diagnostic-interface CVE-2026-108089 posted for all versions · oss-security
What each outlet adds
beyond the shared facts- oss-securityNames XEE in the form processor as CVE-2026-108086, moderate.
- oss-securitySQL injection via SQL processor or sql: and esql: logicsheets.
- oss-securityStates Apache will not release a fix for cache poisoning.
- oss-securityUnauthenticated diagnostic access includes cache, debug, and profile data.
Coverage
oldest first · one row per article · UTC- · 22d ago
oss-securityFirst report
Apache Cocoon XEE flaw can enable SSRF and file disclosure
The retired project’s form processor is affected in every version, and the report names no fixed release.
- · 22d ago
Apache Cocoon SQL processor allows SQL injection (CVE-2026-108087)
Missing input sanitation in the SQL processor or sql: and esql: logicsheets affects every version.
- · 22d ago
Apache Cocoon cache can leak one user's data to another (CVE-2026-108088)
On multi-user apps, cached values for one user can be served to others, and no fix is planned.
- · 22d ago
Apache Cocoon diagnostic interfaces exposed without login (CVE-2026-108089)
Every Cocoon version lets an unauthenticated user trigger caches and read verbose debug and profile data.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108086 | ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon | 7.5 | — | ||
| CVE-2026-108087 | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon | 8.8 | — | ||
| CVE-2026-108088 | ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon | 7.5 | — | ||
| CVE-2026-108089 | Unauthenticated diagnostic info leak in Apache Cocoon (all versions) | 7.5 | — |