CVE-2026-119724

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119724", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-30T15:02:40.663Z", "datePublished": "2026-11-03T09:38:49.421Z", "dateUpdated": "2026-11-06T19:54:49.246Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T09:38:49.421Z"}, "title": "Apache JClouds: XML External Entity (XXE) in provider-response parsing", "problemTypes": [{"descriptions": [{"description": "CWE-776 Improper restriction of recursive entity references in DTDs ('XML entity expansion')", "lang": "en", "cweId": "CWE-776", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache JClouds", "packageURL": "pkg:maven/org.apache.jclouds/jclouds-core", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.jclouds:jclouds-core"}], "descriptions": [{"value": "** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.\n\n\n\nThis issue affects Apache JClouds: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.</p><p>This issue affects Apache JClouds: all versions.</p><p>As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.</p><p>NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/xjzhbdcy6vktgdt3svs3yqv15wvzf4rp", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Gjoko Krstic", "type": "reporter"}], "tags": ["unsupported-when-assigned"], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/02/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-03T10:07:59.286Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T19:54:21.971106Z", "id": "CVE-2026-119724", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T19:54:49.246Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/02/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-03T10:07:59.286Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-119724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T19:54:21.971106Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T19:54:45.498Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Apache JClouds: XML External Entity (XXE) in provider-response parsing", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Gjoko Krstic"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache JClouds", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "semver"}], "packageURL": "pkg:maven/org.apache.jclouds/jclouds-core", "packageName": "org.apache.jclouds:jclouds-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/xjzhbdcy6vktgdt3svs3yqv15wvzf4rp", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.\n\n\n\nThis issue affects Apache JClouds: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "supportingMedia": [{"type": "text/html", "value": "<p>** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.</p><p>This issue affects Apache JClouds: all versions.</p><p>As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.</p><p>NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-776", "description": "CWE-776 Improper restriction of recursive entity references in DTDs ('XML entity expansion')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T09:38:49.421Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119724", "state": "PUBLISHED", "dateUpdated": "2026-11-06T19:54:49.246Z", "dateReserved": "2026-10-30T15:02:40.663Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-11-03T09:38:49.421Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.jclouds:jclouds-core", "packageURL": "pkg:maven/org.apache.jclouds/jclouds-core", "product": "Apache JClouds", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [{"sourceIdentifier": "security@apache.org", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.\n\n\n\nThis issue affects Apache JClouds: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."}], "id": "CVE-2026-119724", "lastModified": "2026-11-06T20:17:14.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119724", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T19:54:21.971106Z", "version": "2.0.3"}}]}, "published": "2026-11-03T10:17:15.150", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/xjzhbdcy6vktgdt3svs3yqv15wvzf4rp"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/02/3"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-776"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.jclouds/jclouds-core: Apache jclouds: Denial of Service via XML entity expansion", "id": "2565663", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565663"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-776", "details": ["** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.\nThis issue affects Apache JClouds: all versions.\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "A flaw was found in Apache jclouds. The XML parser does not properly restrict recursive entity references within Document Type Definitions (DTDs). By submitting a specially crafted XML document containing recursive entity definitions, a remote attacker could consume excessive memory and CPU resources, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-119724", "public_date": "2026-11-03T09:38:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119724\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119724\nhttps://lists.apache.org/thread.html/xjzhbdcy6vktgdt3svs3yqv15wvzf4rp"], "statement": "This vulnerability is rated as Important because an unauthenticated remote attacker can exhaust system CPU and memory resources with minimal complexity, leading to an application-wide denial of service. In Red Hat environments, Apache jclouds is typically embedded within management services to communicate with cloud infrastructure providers. Exposure is limited to scenarios where the application ingests and parses XML payloads from untrusted network sources or compromised cloud API endpoints. Deployments communicating exclusively with trusted endpoints over authenticated channels face lower risk.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache JClouds", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "jclouds", "vendor": "apache"}], "created": "2026-11-03T10:30:13.659513+00:00", "updated": "2026-11-06T02:00:10.172349+00:00", "vendors": ["apache", "apache$PRODUCT$jclouds"]}