java-xmlbuilder xml external entity reference
Priority MEDIUM 45CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.
Why it matters now
EPSS 0.01241 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial com.jamesmurty.utils:java-xmlbuilder (Maven): 1.2Red Hat: 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | java-xmlbuilder | 1.0; 1.1 | — | No fix listed | CNA |
| — | com.jamesmurty.utils:java-xmlbuilder (Maven) | before 1.2 | 1.2 | Patch available | GHSA-3vrc-rrpw-r5pw |
- java-xmlbuilder Vendor— Affected 1.0; 1.1 Fixed in — No fix listed CNA
- com.jamesmurty.utils:java-xmlbuilder (Maven) Vendor— Affected before 1.2 Fixed in 1.2 Patch available GHSA-3vrc-rrpw-r5pw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:java-xmlbuilder_project:java-xmlbuilder:*:*:*:*:*:*:*:* | before 1.2 | Vulnerable | Java-xmlbuilder Project |
- cpe:2.3:a:java-xmlbuilder_project:java-xmlbuilder:*:*:*:*:*:*:*:* Versions before 1.2 Vulnerable ·Java-xmlbuilder Project
Remediation
- Fix · GHSA-3vrc-rrpw-r5pw com.jamesmurty.utils:java-xmlbuilder (Maven) Fixed in 1.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
Not affected: 6 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Apache Camel for Spring Boot 3
Timeline
- 2026-10-02 Threatist record created from CVE-2014-125087
- 2026-10-03 Alias added: GHSA-3vrc-rrpw-r5pw
References
Patch 2
Sources
- CVE-2014-125087 · CVE Program
- CVE-2014-125087 · NVD
- FIRST EPSS
- GHSA-3vrc-rrpw-r5pw · GitHub Advisory Database · CC BY 4.0
- CVE-2014-125087 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences