Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-15803 – XXE Information Disclosure/DoS/SSRF – Eclipse RDF4J before 5.3.2

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-15803 is an XML External Entity (XXE) injection vulnerability in Eclipse RDF4J, an open-source Java framework for processing and querying RDF data. Multiple XML parsing entry points in RDF4J fail to fully restrict DOCTYPE declarations, external entity references, and external DTD loading when processing untrusted XML-based RDF data or SPARQL query results. The flaw is classified as an incomplete remediation of the earlier CVE-2018-1000644 and carries a HIGH severity score of 8.7.

Technical details

  • Root cause: RDF4J’s XML parsing code does not consistently disable DOCTYPE declarations, external entity resolution, or external DTD loading across all parsing paths, leaving gaps that were not closed by the original fix for CVE-2018-1000644.
  • Affected parsing paths: RDF/XML parsing, TriX format handling, SPARQL/XML query results processing, internal DOM helper parsing, transaction XML parsing, and server-boot web.xml parsing.
  • Trigger conditions: An attacker supplies specially crafted XML (RDF/XML, TriX, or SPARQL/XML results) containing malicious DOCTYPE/entity declarations to an application that parses untrusted XML input using vulnerable RDF4J components.
  • Attack vector: Network — exploitable remotely wherever an application accepts and parses untrusted XML-based RDF or SPARQL results using an affected RDF4J version.
  • Impact: Successful exploitation can lead to disclosure of confidential data (e.g., local file contents via external entity resolution), denial of service (e.g., XML entity expansion/"XML bomb" style resource exhaustion), and server-side request forgery (SSRF) via external DTD/entity fetches to attacker-controlled or internal endpoints.

Affected software

  • Eclipse RDF4J: all versions prior to 5.3.2 (semantic versioning)

Severity

  • CVSS v4.0 Score: 8.7 (High)
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • Weakness classifications: CWE-611 (Improper Restriction of XML External Entity Reference), CWE-827 (Improper Control of a Resource Through its Lifetime / DTD control)

Mitigation and recommended actions

  • Immediate: Upgrade Eclipse RDF4J to version 5.3.2 or later, which rejects or disables DOCTYPE declarations, external entity resolution, and external DTD loading by default across all affected parsing paths.
  • If immediate patching is not possible:
    • Avoid parsing XML-based RDF data (RDF/XML, TriX) or SPARQL/XML query results from untrusted or external sources until patched.
    • Where custom XML parser configuration is possible, explicitly disable external entity resolution and DOCTYPE processing (e.g., via XMLConstants.FEATURE_SECURE_PROCESSING and disabling external general/parameter entities) at every application-level XML entry point that feeds into RDF4J.
    • Restrict outbound network access from application/server hosts to reduce SSRF impact from any external entity/DTD fetch attempts.
    • Monitor logs for anomalous XML payloads containing <!DOCTYPE or SYSTEM/PUBLIC entity declarations sent to RDF4J-based endpoints.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge