CVE-2026-113582: UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera
CVE-2026-113582 key facts
- CISA KEV
- Not listed (catalogue checked )
- Highest advisory rating
- High
- CVSS base score
- 8.7 (Apache), 7.5 (Red Hat)
- Weakness
- CWE-611
- Listed by VulniPulse
- Record changed
Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2026-113582; each belongs to its advisory, not to every product listed. How records are collected and checked.
How do I fix CVE-2026-113582?
- Users are recommended to migrate to a maintained alternative. (Apache)
- Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. (Apache)
Vendor advisories for CVE-2026-113582
Apache
1 advisory- Advisory severityHigh8.7
High [CVE-2026-113582] UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera
CVE-2026-113582Source published Source updated
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Affected products in this advisory
- Apache Abdera
- Source-reported affected versions
- Apache Abdera cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Users are recommended to migrate to a maintained alternative.
- Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths.
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-113582] Information disclosure via XML external entity injection
CVE-2026-113582Source published Source updated
Information disclosure via XML external entity injection. Red Hat rates this important (CVSS 7.5). Weakness: CWE-611. Affected product named by the advisory: Red Hat Fuse 7.
- Related products — impact not confirmed
- Red Hat Fuse 7
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
References
More Apache advisories
CVE-2026-86336Nov 10, 2026Apache TomEE running on JDK 21 or later skips EJB method authorization checksCVE-2026-86531Nov 10, 2026The embedded OpenEJB HTTP server does not limit the size of incoming request bodiesCVE-2026-87758Nov 10, 2026The remote EJB client does not verifyCVE-2026-97849Nov 10, 2026The embedded Derby network service ignores its configured bind address and listens on allCVE-2026-97867Nov 10, 2026The EJBd remote protocol returns datasource connection details, including databaseCVE-2026-97870Nov 10, 2026When Hessian remoting endpoints are served by the embedded HTTP server, configured
Get an email when Apache publishes the next one.
See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
