CVE-2026-92877

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-92877

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92877.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-92877

Published

2026-10-12T14:19:28Z

Modified

2026-10-14T02:48:27Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

[none]

Details

The JAXB factory methods historically relied solely on FEATURE_SECURE_PROCESSING to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.

Database specific

{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-611"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92877.json"
}

References

Affected packages

Git / github.com/eclipse-ee4j/jaxb-ri

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-ee4j/jaxb-ri

Events

Introduced

75b0b973d410f512914b38ed079a5b0641b6d480

Last Affected

e155f35f1946261b2f22d4e35a57e80827de29ed

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.0.4"
        },
        {
            "last_affected":  "4.0.4"
        },
        {
            "introduced":  "4.0.9"
        },
        {
            "last_affected":  "4.0.9"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

4.*

4.0.4

4.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92877.json"