Read the docs
TI-2025-04438 Aliases CVE-2025-4949GHSA-vrpq-qp53-qv56

XXE vulnerability in Eclipse JGit

Priority MEDIUM 63CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 21 fixed, 11 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-611 and the CVSS impact.

Summary

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00844 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Eclipse JGit (Eclipse JGit): 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r +2org.eclipse.jgit:org.eclipse.jgit (Maven): 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r +3Red Hat: 21 advisoriesRed Hat: 21 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse JGitEclipse JGit7.2.0 to before 7.2.1.202505142326-r; 7.1.0 to before 7.1.1.202505221757-r; 7.0.0 to before 7.0.1.202505221510-r; before 5.13.4.202507202350-r; 6.0.0 to before 6.10.1.202505221210-r7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 5.13.4.202507202350-r, 6.10.1.202505221210-rPatch availableCNA
Eclipse JGitEclipse JGit7.2.0 to before 7.2.1.202505142326-r; 7.1.0 to before 7.1.1.202505221757-r; 7.0.0 to before 7.0.1.202505221510-r; before 5.13.4.202507202350-r; 6.0.0 to before 6.10.1.202505221210-r7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 5.13.4.202507202350-r, 6.10.1.202505221210-rPatch availableCNA
—org.eclipse.jgit:org.eclipse.jgit (Maven)7.2.0.202503040940-r to before 7.2.1.202505142326-r7.2.1.202505142326-rPatch availableGHSA-vrpq-qp53-qv56
—org.eclipse.jgit:org.eclipse.jgit (Maven)7.1.0.202411261347-r to before 7.1.1.202505221757-r7.1.1.202505221757-rPatch availableGHSA-vrpq-qp53-qv56
—org.eclipse.jgit:org.eclipse.jgit (Maven)7.0.0.202409031743-r to before 7.0.1.202505221510-r7.0.1.202505221510-rPatch availableGHSA-vrpq-qp53-qv56
—org.eclipse.jgit:org.eclipse.jgit (Maven)6.1.0.202203080745-r to before 6.10.1.202505221210-r6.10.1.202505221210-rPatch availableGHSA-vrpq-qp53-qv56
—org.eclipse.jgit:org.eclipse.jgit (Maven)6.0.0.202110060947-m1 to before 6.0.0.202111291000-r6.0.0.202111291000-rPatch availableGHSA-vrpq-qp53-qv56
—org.eclipse.jgit:org.eclipse.jgit (Maven)before 5.13.4.202507202350-r5.13.4.202507202350-rPatch availableGHSA-vrpq-qp53-qv56
  • Eclipse JGit VendorEclipse JGit Affected 7.2.0 to before 7.2.1.202505142326-r; 7.1.0 to before 7.1.1.202505221757-r; 7.0.0 to before 7.0.1.202505221510-r; before 5.13.4.202507202350-r; 6.0.0 to before 6.10.1.202505221210-r Fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 5.13.4.202507202350-r, 6.10.1.202505221210-r Patch available CNA
  • Eclipse JGit VendorEclipse JGit Affected 7.2.0 to before 7.2.1.202505142326-r; 7.1.0 to before 7.1.1.202505221757-r; 7.0.0 to before 7.0.1.202505221510-r; before 5.13.4.202507202350-r; 6.0.0 to before 6.10.1.202505221210-r Fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 5.13.4.202507202350-r, 6.10.1.202505221210-r Patch available CNA
  • org.eclipse.jgit:org.eclipse.jgit (Maven) Vendor— Affected 7.2.0.202503040940-r to before 7.2.1.202505142326-r Fixed in 7.2.1.202505142326-r Patch available GHSA-vrpq-qp53-qv56
  • org.eclipse.jgit:org.eclipse.jgit (Maven) Vendor— Affected 7.1.0.202411261347-r to before 7.1.1.202505221757-r Fixed in 7.1.1.202505221757-r Patch available GHSA-vrpq-qp53-qv56
  • org.eclipse.jgit:org.eclipse.jgit (Maven) Vendor— Affected 7.0.0.202409031743-r to before 7.0.1.202505221510-r Fixed in 7.0.1.202505221510-r Patch available GHSA-vrpq-qp53-qv56
  • org.eclipse.jgit:org.eclipse.jgit (Maven) Vendor— Affected 6.1.0.202203080745-r to before 6.10.1.202505221210-r Fixed in 6.10.1.202505221210-r Patch available GHSA-vrpq-qp53-qv56
  • org.eclipse.jgit:org.eclipse.jgit (Maven) Vendor— Affected 6.0.0.202110060947-m1 to before 6.0.0.202111291000-r Fixed in 6.0.0.202111291000-r Patch available GHSA-vrpq-qp53-qv56
  • org.eclipse.jgit:org.eclipse.jgit (Maven) Vendor— Affected before 5.13.4.202507202350-r Fixed in 5.13.4.202507202350-r Patch available GHSA-vrpq-qp53-qv56

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*before 5.13.4; 6.0.0 to before 6.10.1.202505221210; 7.0.0 to before 7.0.1.202505221510; 7.1.0 to before 7.1.1.202505221757; 7.2.0 to before 7.2.1.202505142326VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:* Versions before 5.13.4; 6.0.0 to before 6.10.1.202505221210; 7.0.0 to before 7.0.1.202505221510; 7.1.0 to before 7.1.1.202505221757; 7.2.0 to before 7.2.1.202505142326 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · CNA Eclipse JGit (Eclipse JGit) Fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 5.13.4.202507202350-r, 6.10.1.202505221210-r
  • Fix · CNA Eclipse JGit (Eclipse JGit) Fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 5.13.4.202507202350-r, 6.10.1.202505221210-r
  • Fix · GHSA-vrpq-qp53-qv56 org.eclipse.jgit:org.eclipse.jgit (Maven) Fixed in 7.2.1.202505142326-r Advisory →
  • Fix · GHSA-vrpq-qp53-qv56 org.eclipse.jgit:org.eclipse.jgit (Maven) Fixed in 7.1.1.202505221757-r Advisory →
  • Fix · GHSA-vrpq-qp53-qv56 org.eclipse.jgit:org.eclipse.jgit (Maven) Fixed in 7.0.1.202505221510-r Advisory →
  • Fix · GHSA-vrpq-qp53-qv56 org.eclipse.jgit:org.eclipse.jgit (Maven) Fixed in 6.10.1.202505221210-r Advisory →
  • Fix · GHSA-vrpq-qp53-qv56 org.eclipse.jgit:org.eclipse.jgit (Maven) Fixed in 6.0.0.202111291000-r Advisory →
  • Fix · GHSA-vrpq-qp53-qv56 org.eclipse.jgit:org.eclipse.jgit (Maven) Fixed in 5.13.4.202507202350-r Advisory →

Red Hat 21 advisories

  • RHSA-2026:6011 Released 2026-03-30 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.3.17 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-3.SP2_redhat_00003.1.el7eap, eap7-apache-cxf-rt-3.4.10-3.SP2_redhat_00003.1.el7eap, eap7-apache-cxf-services-3.4.10-3.SP2_redhat_00003.1.el7eap +14
  • RHSA-2026:4924 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.24 io.netty.netty-codec-http2-4.1.124.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.39.Final-redhat-00001.jar, org.apache.cxf.cxf-rt-transports-jms-3.5.11.SP1-redhat-00001.jar +2
  • RHSA-2026:4917 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el9eap +40
Show 18 more Red Hat advisories
  • RHSA-2026:4915 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el7eap +42
  • RHSA-2026:4916 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el8eap +43
  • RHSA-2025:23491 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2025:23492 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2025:23490 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2025:23488 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2025:23489 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2025:23487 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2025:23486 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2025:23485 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2025:23482 Released 2025-12-17 · Red Hat rating Moderate
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2025:22773 Released 2025-12-04 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.11 security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-angus-activation-2.0.2-2.redhat_00002.1.el8eap, eap8-apache-commons-io-2.16.1-2.redhat_00002.1.el8eap, eap8-atinject-2.0.1-5.redhat_00007.1.el8eap +47
  • RHSA-2025:22775 Released 2025-12-04 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.11 security update
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-angus-activation-2.0.2-2.redhat_00002.1.el9eap, eap8-apache-commons-io-2.16.1-2.redhat_00002.1.el9eap, eap8-atinject-2.0.1-5.redhat_00007.1.el9eap +47
  • RHSA-2025:22777 Released 2025-12-04 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.11 security update
    • Red Hat JBoss Enterprise Application Platform 8.0
  • RHSA-2025:22190 Released 2025-11-26 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.1.2 security update
    • Red Hat JBoss Enterprise Application Platform org.eclipse.jgit.org.eclipse.jgit-6.10.1.202505221210-r-redhat-00002.jar
  • RHSA-2025:22188 Released 2025-11-26 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.1.2 Security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-3.redhat_00008.1.el9eap, eap8-activemq-artemis-cli-2.40.0-3.redhat_00008.1.el9eap, eap8-activemq-artemis-commons-2.40.0-3.redhat_00008.1.el9eap +47
  • RHSA-2025:22187 Released 2025-11-26 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.1.2 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-3.redhat_00008.1.el8eap, eap8-activemq-artemis-cli-2.40.0-3.redhat_00008.1.el8eap, eap8-activemq-artemis-commons-2.40.0-3.redhat_00008.1.el8eap +47
  • RHSA-2025:18028 Released 2025-10-14 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10.7 for Spring Boot release.
    • Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix yet
Cryostat 3AffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
streams for Apache KafkaAffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2025:23487
OpenShift Developer Tools and Services 4.13Fixed RHSA-2025:23482
OpenShift Developer Tools and Services 4.14Fixed RHSA-2025:23485
OpenShift Developer Tools and Services 4.15Fixed RHSA-2025:23486
OpenShift Developer Tools and Services 4.16Fixed RHSA-2025:23490
OpenShift Developer Tools and Services 4.17Fixed RHSA-2025:23489
OpenShift Developer Tools and Services 4.18Fixed RHSA-2025:23492
OpenShift Developer Tools and Services 4.19Fixed RHSA-2025:23488
OpenShift Developer Tools and Services 4.20Fixed RHSA-2025:23491
Red Hat JBoss EAP 7.4 ELS for RHEL 7 ServerFixed RHSA-2026:4915
Red Hat JBoss EAP 7.4 ELS for RHEL 8Fixed RHSA-2026:4916
Red Hat JBoss EAP 7.4 ELS for RHEL 9Fixed RHSA-2026:4917
Red Hat JBoss EAP 8.0 for RHEL 8Fixed RHSA-2025:22773
Red Hat JBoss EAP 8.0 for RHEL 9Fixed RHSA-2025:22775
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2025:22187
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2025:22188
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2025:22190
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:6011
Red Hat JBoss Enterprise Application Platform 7.4.24Fixed RHSA-2026:4924
Red Hat JBoss Enterprise Application Platform 8.0Fixed RHSA-2025:22777
Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10Fixed RHSA-2025:18028
Not affected: 22 products
  • Cryostat 4
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 ELS for RHEL 8
  • Red Hat JBoss EAP 7.4 ELS for RHEL 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform 7.4.24
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Single Sign-On 7
  • Red Hat build of OptaPlanner 8
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4949
  2. 2026-10-03 Alias added: GHSA-vrpq-qp53-qv56
  3. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform · Red Hat

References

Exploit 1

Advisory 2

Other 7

  • TI-2014-07619 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… CVSS 3.1CRITICAL 9.8
  • TI-2023-04387 Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences