CVE-2026-127031

Eclipse AAS4J versions before 3.0.1 are vulnerable to an XML External Entity (XXE) and Server-Side Request Forgery (SSRF) issue. The root cause is that XmlSchemaValidator.validateSchema() (and AASXValidator.validateSchema()) uses a default JAXP Validator that resolves external DTDs and entities w...

PT-2026-146889

In Eclipse AAS4J before 3.0.1, XmlSchemaValidator.validateSchema and AASXValidator.validateSchema, which calls it validates untrusted XML with a default JAXP Validator that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read...