Cyber ·
CVE-2026-119724: XXE in Apache JClouds with no planned fix
XML entity expansion vulnerability in Apache JClouds, affecting all versions, with the project discontinued and no corrective release. Disclosed on the oss-sec mailing list on 2 November 2026.
According to the advisory relayed by the oss-sec mailing list, posted by Arnout Engelen on 2 November 2026, the flaw is rated moderate and affects all versions of Apache JClouds. The issue is improper restriction of recursive entity references in DTDs, known as XML entity expansion, which can occur while parsing provider responses. The advisory marks the case as unsupported when assigned. Because the project has been discontinued, no corrective version is planned. The advisory's own recommendation is that users find an alternative or restrict access. For the reader, the key point is to check whether JClouds appears in your dependencies, including transitive ones. Rota Nacional does not patch third-party libraries: personal data detection before models and the audit trail protect content in transit, but they do not replace updating or replacing the affected component. Consult the original advisory for technical details and confirm the scope before acting.
Original source: CVE-2026-119724: XXE no Apache JClouds durante a análise de respostas do provedor