CVE-2026-15803

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.

CVSS

No CVSS.

References

Link	Resource
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/175
https://rdf4j.org/release-notes/5.3.2/

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En Eclipse RDF4J, varios puntos de entrada del analizador XML no restringen completamente el procesamiento de entidad externa XML (XXE) al analizar datos RDF basados en XML no confiables o resultados de consulta, permitiendo declaraciones DOCTYPE, referencias a entidades externas y la carga de DTD externos. Esto se debe a una corrección incompleta para CVE-2018-1000644: la corrección anterior no cubría todos los puntos de entrada del analizador. El problema se resuelve en RDF4J 5.3.2, que rechaza o deshabilita las declaraciones DOCTYPE, las entidades externas y la carga de DTD externos por defecto.

Information

Published : 2026-08-12 16:16

Updated : 2026-10-23 20:10

NVD link : CVE-2026-15803

Mitre link : CVE-2026-15803

CVE.ORG link : CVE-2026-15803

JSON object : View

Products Affected

No product.

CWE

CWE-611

Improper Restriction of XML External Entity Reference

CWE-827

Improper Control of Document Type Definition

{"id": "CVE-2026-15803", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15803", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T18:37:16.500730Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Eclipse RDF4J", "versions": [{"status": "affected", "version": "0", "lessThan": "5.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T16:16:54.877", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/175", "source": "emo@eclipse.org"}, {"url": "https://rdf4j.org/release-notes/5.3.2/", "source": "emo@eclipse.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-611"}, {"lang": "en", "value": "CWE-827"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default."}, {"lang": "es", "value": "En Eclipse RDF4J, varios puntos de entrada del analizador XML no restringen completamente el procesamiento de entidad externa XML (XXE) al analizar datos RDF basados en XML no confiables o resultados de consulta, permitiendo declaraciones DOCTYPE, referencias a entidades externas y la carga de DTD externos. Esto se debe a una correcci\u00f3n incompleta para CVE-2018-1000644: la correcci\u00f3n anterior no cubr\u00eda todos los puntos de entrada del analizador. El problema se resuelve en RDF4J 5.3.2, que rechaza o deshabilita las declaraciones DOCTYPE, las entidades externas y la carga de DTD externos por defecto."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "emo@eclipse.org"}