XML external entity expansion in Apache Abdera Atom document parsing
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-611 and the CVSS impact.
Summary
Apache Abdera, all versions, is affected. Improper restriction of XML external entity references (CWE-611) lets attackers access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. An unauthenticated remote attacker needs only to supply XML that the application parses.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Apache Abdera. The project is retired, so users should migrate to a maintained alternative, and applications that cannot migrate should ensure untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Red Hat lists Red Hat Fuse 7 as affected with no plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet |
Timeline
- 2026-10-22 Threatist record created from CVE-2026-113582
- 2026-10-22 Alias added: GHSA-7wc2-gp9g-c8r6
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: LOW → MEDIUM
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
More Apache vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
- TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-113582 · CVE Program
- CVE-2026-113582 · NVD
- FIRST EPSS
- GHSA-7wc2-gp9g-c8r6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-113582 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences