Improper Restriction of Recursive Entity References in Apache Cocoon

CVE-2026-108086

What is CVE-2026-108086?

An improper restriction of recursive entity references in the XML processing component of Apache Cocoon has been identified. This vulnerability exposes the system to XML entity expansion attacks, potentially leading to server-side request forgery (SSRF). Specifically, this flaw allows unauthorized external systems to access server files via the form processor feature. Since Apache Cocoon is a retired project, no patches or updates are planned. Users are advised to migrate to alternative solutions or restrict system access to trusted users only.

References