CVE-2026-113582— Apache Abdera: XML external entity expansion in Atom document parsing
Quick assessment
Affected
Apache Software Foundation Apache Abdera
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当被分配时不受支持：Apache Abdera 中对外部 XML 实体引用的限制不当，导致当应用程序使用 Abdera 解析由攻击者控制的 XML 时，攻击者可访问敏感数据或发起服务器端请求。 受影响范围：Apache Abdera 的所有版本。 Apache Abdera 已停止维护且不再提供支持，因此我们计划不再发布修复此问题的版本。建议用户迁移至受维护的替代方案。对于无法迁移的应用程序，应确保不可信的 XML 无法进入受影响的 Abdera 解析器或 JDBC 适配器解析路径。若下游活跃维护的产品中包含了受影
Affected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Abdera | ≤ * |
affected |
≤ * |
affected | ||
cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2≤ * |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113582
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Abdera: XML external entity expansion in Atom document parsing
Source: CVE Program / CVE List V5
Vulnerability Description
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera.
This issue affects Apache Abdera: all versions.
Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Abdera | 0 ~ * | - |
|
| Apache Software Foundation | Apache Abdera | 0 ~ * | - |
|
| Apache Software Foundation | Apache Abdera | cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2 ~ * | - |
|
II. Public POCs for CVE-2026-113582
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113582
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-113582 (1)
Vendor Pages for CVE-2026-113582 (1)
-
🔗 Abdera | The Apache Attic product
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-103634
Apache DataSketches: datasketches-cpp: Out-of-bounds read an -
CVE-2026-112381
Apache Traffic Server: Nullptr dereference in net_write_io o -
CVE-2026-111817
Apache Traffic Server: Dropping chunked trailers stalls a pa -
CVE-2026-111812
Apache Traffic Server: origin_server_auth signs client-contr -
CVE-2026-111811
Apache Traffic Server: tsmemcache plugin exposes the shared
Same weakness: CWE-611
-
CVE-2026-108357
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentit -
CVE-2026-108358
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequen -
CVE-2026-97400
jdmpview / DTFJ reads arbitrary local files and makes arbitr -
CVE-2026-91858
Apache Camel: Camel-FOP Resolves External DTDs and Entities -
CVE-2026-88901
Apache Camel: Camel-Smooks XML External Entity Processing, e
V. Comments for CVE-2026-113582
No comments yet