CVE-2026-113582 Details
Description
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability exists in Apache Abdera due to improper restriction of XML external entity references. This issue allows an attacker to access sensitive data or make server-side requests by exploiting the Abdera parser with attacker-controlled XML. All versions of Apache Abdera are affected. However, since Abdera is retired and no longer supported, no fix will be released. Users are advised to migrate to a maintained alternative. For applications that cannot migrate, it is recommended to prevent untrusted XML from reaching the Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may also be impacted if they include an affected Abdera artifact.
Users are recommended to migrate to a maintained alternative. For applications that cannot migrate, ensure that untrusted XML does not reach the Abdera parser or JDBC adapter parsing paths.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/10/22/10 | CVE | |
| https://attic.apache.org/projects/abdera.html | [email protected] | ProductVendor |
| https://lists.apache.org/thread.html/j32tow7bhfnn2p0obsqy1mhg1qs7hq91 | [email protected] | AdvisoryMailing ListVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Abdera | <= cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | CVE Modified | CVE |
| Oct 22, 2026 | New CVE Received | [email protected] |