com.chutneytesting:server (1.3.1), fi.sn127:tackler-core_2.12 (0.8.0) +32 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.9.1.201712030800-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.9.1.201712030800-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - com.chutneytesting:server 1.3.1 - fi.sn127:tackler-core2.12 0.8.0 -...

com.alexanderthelen.gitrepositoriesplugin:com.alexanderthelen.gitrepositoriesplugin.gradle.plugin (>=1.1.0, <=1.4.0), com.cosium.code:maven-git-code-format (>=1.1, <=1.28) +91 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.9.0.201710071750-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.9.0.201710071750-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: -...

au.csiro:elk-distribution-protege (0.5.0), au.csiro:elk-protege (0.5.0) +423 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.8.0.201706111038-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.8.0.201706111038-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - au.csiro:elk-distribution-protege 0.5.0 - au.csiro:elk-protege 0.5.0 -...

com.github.bzumhagen:sct_2.10 (>=0.6.0, <=0.11.1), com.github.bzumhagen:sct_2.11 (>=0.6.0, <=0.11.1) +15 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.8.0.201705170830-rc1)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.8.0.201705170830-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - com.github.bzumhagen:sct2.10 =0.6.0, =0.6.0, =0.5.0, =3.0.0, =3.0.13 -...

org.eclipse.jgit:org.eclipse.jgit.ant (4.7.9.201904161809-r), org.eclipse.jgit:org.eclipse.jgit.archive (4.7.9.201904161809-r) +8 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.7.9.201904161809-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.7.9.201904161809-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.eclipse.jgit:org.eclipse.jgit.ant 4.7.9.201904161809-r -...

com.beijunyi:parallelgit (1.0.0), com.beijunyi:parallelgit-commands (1.0.0) +40 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.1.0.201509280440-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.1.0.201509280440-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - com.beijunyi:parallelgit 1.0.0 - com.beijunyi:parallelgit-commands 1.0.0 -...

au.com.versent.jenkins.plugins:ignore-committer-strategy (29.v7c3891a_434c3), box.tapsi.build:tapsibox-convention-plugin (>=0.0.1, <=0.0.5-rc1) +1712 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (>=6.0.0.202111291000-r, <=6.10.0.202406032230-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version =6.0.0.202111291000-r, =0.0.1, =0.0.1, =0.3.8, =0.3.8, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0, =8.4.0, =1.5.0, =0.3.12, =1.0.0 and more Source cves: CVE-2025-4949 Source advisory:...

ai.hyacinth.framework:core-service-config-server (>=0.5.0, <=0.5.24), at.nonblocking:nonsnapshot-maven-plugin (4.0.1) +3176 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (>=5.0.0.201805151920-m7, <=5.13.3.202401111512-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version =5.0.0.201805151920-m7, =0.5.0, =1.2.0, =0.0.2, =0.0.21, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =0.0.11, =1.0.12, =0.0.1, =1.0.12, =1.0.30 and more Source cves: CVE-2025-4949 Source advisory: GHSA-VRPQ-QP53-QV56...

org.eclipse.jgit:org.eclipse.jgit.ant (4.11.2.201809100523-r), org.eclipse.jgit:org.eclipse.jgit.archive (4.11.2.201809100523-r) +8 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.11.2.201809100523-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.11.2.201809100523-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.eclipse.jgit:org.eclipse.jgit.ant 4.11.2.201809100523-r -...

com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.0.0.release, <=2.0.1.release), com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.0.2.release, <=2.0.4.release) +266 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.11.0.201803080745-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.11.0.201803080745-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server =2.0.0.release,...

org.eclipse.jgit:org.eclipse.jgit.ant (4.7.5.201810051826-r), org.eclipse.jgit:org.eclipse.jgit.archive (4.7.5.201810051826-r) +8 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.7.5.201810051826-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.7.5.201810051826-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.eclipse.jgit:org.eclipse.jgit.ant 4.7.5.201810051826-r -...

org.eclipse.jgit:org.eclipse.jgit.ant (4.7.4.201809180905-r), org.eclipse.jgit:org.eclipse.jgit.archive (4.7.4.201809180905-r) +8 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.7.4.201809180905-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.7.4.201809180905-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.eclipse.jgit:org.eclipse.jgit.ant 4.7.4.201809180905-r -...

org.eclipse.jgit:org.eclipse.jgit.ant (4.7.3.201809090215-r), org.eclipse.jgit:org.eclipse.jgit.archive (4.7.3.201809090215-r) +8 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.7.3.201809090215-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.7.3.201809090215-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.eclipse.jgit:org.eclipse.jgit.ant 4.7.3.201809090215-r -...

org.eclipse.jgit:org.eclipse.jgit.ant (4.7.2.201807261330-r), org.eclipse.jgit:org.eclipse.jgit.archive (4.7.2.201807261330-r) +8 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.7.2.201807261330-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.7.2.201807261330-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.eclipse.jgit:org.eclipse.jgit.ant 4.7.2.201807261330-r -...

com.dell.doradus:doradus-dynamodb (2.4.0), com.dell.doradus:doradus-jetty (>=2.3.1, <=2.4.0) +9 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.0.0.201506020755-rc3)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.0.0.201506020755-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - com.dell.doradus:doradus-dynamodb 2.4.0 - com.dell.doradus:doradus-jetty...

org.eclipse.jgit:org.eclipse.jgit.ant (4.11.3.201809181037-r), org.eclipse.jgit:org.eclipse.jgit.archive (4.11.3.201809181037-r) +8 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.11.3.201809181037-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.11.3.201809181037-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.eclipse.jgit:org.eclipse.jgit.ant 4.11.3.201809181037-r -...

io.helidon.config:helidon-config-git (>=1.4.1, <=2.3.0), io.helidon:helidon-javadocs (>=1.4.1, <=2.0.0-m1) +10 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.9.9.201903122025-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.9.9.201903122025-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - io.helidon.config:helidon-config-git =1.4.1, =1.4.1, =2.0.0-m1 -...

CVE-2025-4949

A flaw was found in Eclipse JGit. This vulnerability can allow information disclosure, denial of service, and other security issues via parsing XML files...

CVE-2025-4949

CVE-2025-4949 is an XXE vulnerability in Eclipse JGit (ManifestParser used by repo and AmazonS3 transport). IBM documentation links this CVE to IBM WebMethods Integration (on prem) 11.1 with fixes in 11.1 Fix 2 and related 2.0.3 components; IBM security pages list a remediation path via updating ...

CVE-2025-4949 XXE vulnerability in Eclipse JGit

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity XXE...