XML Entity Expansion Vulnerability in Apache JClouds
CVE-2026-119724

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Jclouds
Vendor
CVE Published:
3 November 2026

What is CVE-2026-119724?

The vulnerability in Apache JClouds arises from improper restriction of recursive entity references in DTDs, enabling an attacker to exploit XML entity expansion. This can lead to denial of service and excessive resource consumption. Given that Apache JClouds is a retired project, no fixes will be provided. Users are advised to seek alternatives or limit access to the instances to trusted users.

Affected Version(s)

Apache JClouds 0

References

https://lists.apache.org/thread.html/xjzhbdcy6vktgdt3svs3...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gjoko Krstic
.