Read the docs
TI-2022-11511 Aliases CVE-2022-28890GHSA-gchv-364h-r896

Processing external DTDs

Priority MEDIUM 47CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

Why it matters now

EPSS 0.02668 85th percentileScored 2026-11-07
Fix Fixed org.apache.jena:jena (Maven): 4.5.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache JenaApache Jena – 4.4.0—No fix listedCNA
—org.apache.jena:jena (Maven)4.4.0 to before 4.5.04.5.0Patch availableGHSA-gchv-364h-r896
  • Apache Jena VendorApache Affected Apache Jena – 4.4.0 Fixed in — No fix listed CNA
  • org.apache.jena:jena (Maven) Vendor— Affected 4.4.0 to before 4.5.0 Fixed in 4.5.0 Patch available GHSA-gchv-364h-r896

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:jena:4.4.0:*:*:*:*:*:*:*4.4.0VulnerableApache
  • cpe:2.3:a:apache:jena:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-gchv-364h-r896 org.apache.jena:jena (Maven) Fixed in 4.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28890
  2. 2026-10-03 Alias added: GHSA-gchv-364h-r896

References

Advisory 2

Other 2

  • TI-2023-15499 Apache Jena: Exposure of execution in script engine expressions. CVSS 3.1HIGH 8.8
  • TI-2025-32034 Apache Jena: Configuration files uploaded by administrative users are not check properly CVSS 3.1HIGH 8.8
  • TI-2025-31627 Apache Jena: Administrative users can create files outside the server directory space via the admin UI CVSS 3.1HIGH 7.5
  • TI-2021-16624 XML external entity (XXE) in Apache Jena CVSS 3.1HIGH 7.5
  • TI-2023-08840 Apache Jena: Exposure of arbitrary execution in script engine expressions. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences