XML External Entity Processing Flaw in Eclipse RDF4J

CVE-2026-15803

What is CVE-2026-15803?

In Eclipse RDF4J, a vulnerability exists that allows XML External Entity (XXE) processing due to insufficient restrictions on XML parser entry points. This flaw can be exploited when parsing untrusted XML-based RDF data or query results, allowing attackers to introduce DOCTYPE declarations, access external entity references, and load external DTDs. The issue stems from the incomplete resolution of a prior vulnerability (CVE-2018-1000644), which left certain parser entry points unprotected. The vulnerability has been addressed in RDF4J version 5.3.2, which now defaults to rejecting DOCTYPE declarations, external entities, and DTD loading.

References