CVE-2026-119724
Received Received - Intake

XML Entity Expansion Flaw in Apache JClouds

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Apache Software Foundation

Description
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-119724
EUVD
EUVD-2026-115730

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache JClouds 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-776 The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119724 is an XML External Entity (XXE) vulnerability in Apache JClouds caused by improper handling of recursive entity references in DTDs. This allows XML entity expansion attacks, potentially leading to denial of service or unauthorized data access.

Detection Guidance

Detection requires checking if Apache JClouds is running and analyzing XML parsing configurations for entity expansion risks. Since the project is retired, no official tools are available. Review logs for unusual XML parsing errors or excessive entity references.

Impact Analysis

This vulnerability could allow attackers to perform denial of service via excessive XML parsing or access sensitive data if the system processes untrusted XML inputs. Since Apache JClouds is retired, no official patch exists.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is an XML External Entity (XXE) issue in a retired and unsupported product. However, using unsupported software may violate compliance requirements that mandate supported and patched systems.

Mitigation Strategies

Immediately migrate to an alternative solution as Apache JClouds is unsupported. If migration is not possible, restrict network access to trusted users only and disable XML parsing features if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...