CVE-2026-119724: Apache JClouds: XML External Entity (XXE) in provider-response parsing
CVE-2026-119724 key facts
- CISA KEV
- Not listed (catalogue checked )
- Highest advisory rating
- High
- CVSS base score
- 7.5 (Red Hat)
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N· base score 7.5, scored by CISA-ADPAttack vector: network. Attack complexity: low. Privileges required: none. User interaction: none. Scope: unchanged. Confidentiality impact: high. Integrity impact: none. Availability impact: none.- Weakness
- CWE-776 Improper restriction of recursive entity references in DTDs ('XML entity expansion')
- EPSS
- 0.44% chance of exploitation in the next 30 days (38th percentile). FIRST EPSS, .
- CISA SSVC
- Exploitation: none observed. Automatable: yes. Technical impact: partial. CISA, .
- Assigned by
- apache (CNA)
- CVE record published
- Listed by VulniPulse
- Record changed
Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2026-119724; each belongs to its advisory, not to every product listed. How records are collected and checked.
Description
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Text from the CVE.org record (apache).
Vendor advisories for CVE-2026-119724
Apache
1 advisory- Advisory severityUnrated
Advisory [CVE-2026-119724] Apache JClouds: XML External Entity (XXE) in provider-response parsing
CVE-2026-119724Source published Source updated
- * UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Affected products in this advisory
- Apache JClouds
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Workarounds
- Users are recommended to find an alternative or restrict access to the instance to trusted users.
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-119724] Apache jclouds: Denial of Service via XML entity expansion
CVE-2026-119724Source published Source updated
Apache jclouds: Denial of Service via XML entity expansion. Red Hat rates this important (CVSS 7.5). Weakness: CWE-776.
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
References
Timeline
- CVE record published
- First vendor advisory listed by VulniPulse
- CVE record last updated
More Apache advisories
CVE-2026-89326Nov 11, 2026Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resourceCVE-2026-106023Nov 11, 2026NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP requestCVE-2026-109163Nov 11, 2026Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_aliasCVE-2026-119618Nov 11, 2026Concurrent Execution using Shared Resource with Improper SynchronizationCVE-2026-71395Nov 11, 2026unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOPCVE-2026-44929Nov 11, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik
Get an email when Apache publishes the next one.
See Apache's last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.