CVE-2026-15803
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Eclipse RDF4J has insufficient restriction of XML External Entity (XXE) processing in several XML parser entry points, allowing DOCTYPE declarations, external entity references, and external DTD loading. The issue is fixed in version 5.3.2.
Risk Assessment
Potential file disclosure, SSRF attacks, or other confidentiality breaches.
Recommendation
Upgrade Eclipse RDF4J to version 5.3.2 or later.
Original NVD description (English source)
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.