CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera.
This issue affects Apache Abdera: all versions.
Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure untrusted XML cannot reach the affected Apache Abdera parser or JDBC adapter parsing paths.
Event History
Frequently Asked Questions
Which deployments are exposed?
Any application using any version of Apache Abdera is exposed if attacker-controlled XML can reach an Abdera parser or JDBC adapter parsing path. Maintained downstream products may also be affected when they include an affected Abdera artifact.
What does an attacker need to exploit this issue?
An attacker needs to cause the application to parse XML they control with Apache Abdera. No authentication or user interaction is indicated by the supplied severity vector.
Is a patch available?
No. Apache Abdera is retired and unsupported, and its maintainers do not plan to release a fixed version; migration to a maintained alternative is recommended.
What can be done if migration cannot happen immediately?
Prevent untrusted XML from reaching affected Abdera parser or JDBC adapter parsing paths. This is the stated mitigation for applications that cannot migrate.