105 matches found
CVE-2026-88901
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...
CVE-2026-88901 Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...
EUVD-2026-104206
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...
CVE-2026-88901
The camel-smooks component in Apache Camel (versions 4.7.0 before 4.18.5 and 4.19.0 before 4.22.1) is vulnerable to XML External Entity (XXE) processing. The issue stems from the Woodstox SAX parser resolving external general/parameter entities and external DTDs by default, without the hardening ...
CVE-2026-88901 Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...
PT-2026-117365
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...
Astra Linux – Vulnerability in libwoodstox-java
Those who use Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow. This vulnerability could potentially all...
ROOT-APP-MAVEN-CVE-2022-40153 CVE-2022-40153 in com.fasterxml.woodstox:woodstox-core - Patched by Root
Root has patched CVE-2022-40153 in the com.fasterxml.woodstox:woodstox-core package for Root:Maven. Multiple fixed versions available...
Security Bulletin: Multiple Vulnerabilities in IBM API Connect
Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.2 Vulnerability Details CVEID:CVE-2022-40152 DESCRIPTION: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user suppli...
CLSA-2026-1773101686 TuxCare security update for com.fasterxml.woodstox:woodstox-core (1 CVE)
TuxCare rebuilt com.fasterxml.woodstox:woodstox-core to address 1 CVE. Fixed in 5.3.0-tuxcare.1...
CLSA-2024-1733443231 TuxCare security update for com.fasterxml.woodstox:woodstox-core (1 CVE)
TuxCare rebuilt com.fasterxml.woodstox:woodstox-core to address 1 CVE. Fixed in 5.0.3.tuxcare...
PT-2026-73904
TuxCare rebuilt com.fasterxml.woodstox:woodstox-core to address 1 CVE. Fixed in 5.3.0-tuxcare.1...
PT-2026-73454
TuxCare rebuilt com.fasterxml.woodstox:woodstox-core to address 1 CVE. Fixed in 5.0.3.tuxcare...
OPENSUSE-SU-2026:11226-1 woodstox-core-7.2.1-1.1 on GA media
These are all security issues fixed in the woodstox-core-7.2.1-1.1 package on the GA media of openSUSE Tumbleweed...
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: JRE built-in...
CVE-2026-34480
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/charsets producing invalid XML output whenever a log message or M...
xstream:XmlFuzzer: Security exception in java.base/java.lang.AbstractStringBuilder.<init>
Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5030804760887296 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
keycloak:SamlParserFuzzer: Security exception in com.ctc.wstx.util.WordResolver$Builder.constructBranch
Detailed Report: https://oss-fuzz.com/testcase?key=6658399025823744 Project: keycloak Fuzzing Engine: libFuzzer Fuzz Target: SamlParserFuzzer Job Type: libfuzzerasankeycloak Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
maven-model:Xpp3ReaderFuzzer: Security exception in com.ctc.wstx.util.TextBuffer.buildResultArray
Project: https://github.com/apache/maven.git Detailed Report: https://oss-fuzz.com/testcase?key=6041510725615616 Project: maven-model Fuzzing Engine: libFuzzer Fuzz Target: Xpp3ReaderFuzzer Job Type: libfuzzerasanmaven-model Platform Id: linux Crash Type: Security exception Crash Address: Crash...
PT-2026-21386
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=480987597 Crash type: Security exception Crash state: com.ctc.wstx.util.TextBuffer.buildResultArray com.ctc.wstx.util.TextBuffer.contentsAsArray com.ctc.wstx.dtd.FullDTDReader.parseEntityValue...