Eclipse RDF4J <5.3.2: XML External Entity (XXE) Vulnerability in XML Parser
CVE-2026-15803 Published on August 12, 2026
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.
Vulnerability Analysis
CVE-2026-15803 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
What is a XXE Vulnerability?
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVE-2026-15803 has been classified to as a XXE vulnerability or weakness.
Improper Control of Document Type Definition
The software does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the software to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
Products Associated with CVE-2026-15803
Want to know whenever a new CVE is published for Eclipse Rdf4j? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse RDF4J:- Before 5.3.2 is affected.