CVE-2026-15803
Received Received - Intake

XXE Vulnerability in Eclipse RDF4J

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Eclipse Foundation

Description
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-15803
EUVD
EUVD-2026-57314

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eclipse rdf4j to 5.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CWE-827 The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an XML External Entity (XXE) vulnerability in Eclipse RDF4J before version 5.3.2. Several XML parser entry points do not fully restrict XXE processing when parsing untrusted XML-based RDF data or query results. This allows DOCTYPE declarations, external entity references, and external DTD loading, which can lead to security risks like data disclosure or denial of service.

Detection Guidance

To detect this vulnerability, check if your Eclipse RDF4J instance is running a version prior to 5.3.2. Use commands like 'rdf4j --version' or inspect the version in your application logs or dependency files.

Impact Analysis

An attacker could exploit this to access sensitive data, cause denial of service, or perform server-side requests by crafting malicious XML input. Systems parsing untrusted XML-based RDF data or query results are particularly at risk.

Mitigation Strategies

Upgrade Eclipse RDF4J to version 5.3.2 or later immediately. This version disables DOCTYPE declarations, external entities, and external DTD loading by default, closing the XXE vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart