CVE-2026-92877 | BDVDB-2026-386038 Detail
Eclipse Foundationjaxb-ri (core)
Description#
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
Impact#
Per CVSS v4.0: confidentiality impact high, integrity impact none, availability impact low. Attack vector: network.
Weaknesses#
- CWE-611 Improper Restriction of XML External Entity Reference
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.