XML External Entity Vulnerability in Eclipse JAXB

CVE-2026-92877

What is CVE-2026-92877?

The JAXB factory methods previously depended solely on the FEATURE_SECURE_PROCESSING flag to mitigate risks associated with XML External Entity (XXE) vulnerabilities. However, in certain JAXP implementations, reliance on this feature alone may not prevent external entity resolutions. Consequently, an attacker capable of passing untrusted XML through JAXB can exploit this weakness to read sensitive local files through out-of-band XXE attacks. It is critical for users of affected JAXB versions to apply necessary updates or implement additional safeguards to avert exploitation.

References