GHSA-fpvp-qwgm-v6h9: Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Q: Who is exposed to this issue?

Applications using the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper versions 3.3.0 through 4.2.0 are exposed if an actor can write to the shared cache infrastructure. Hosts that read cached query results may disclose sensitive local files, including stored database and IAM role credentials.

Q: What does an attacker need to exploit it?

The attacker needs write access to the shared cache infrastructure and must place crafted XML data in a cached column value. No additional user interaction is required.

Q: What should teams do if they are running an affected version?

Upgrade the AWS Advanced JDBC Wrapper to version 4.3.0 or later. If upgrading cannot happen immediately, restrict and review write access to the shared cache infrastructure to prevent untrusted parties from inserting crafted cached values.

Q: How can teams determine whether they are affected?

Check whether the application uses the RemoteQueryCachePlugin and is running AWS Advanced JDBC Wrapper version 3.3.0 through 4.2.0. Also identify whether the shared cache infrastructure permits write access by actors who should not be trusted to supply cached query-result data.

Published Sep 11, 2026

Updated

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value.

To remediate this issue, users should upgrade to version 4.3.0 or later.

Affected Software

1 affected component

AWS Advanced JDBC Wrapper RemoteQueryCachePlugin>=3.3.0<=4.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade AWS Advanced JDBC Wrapper to a version that resolves this vulnerability.
Fixed in 4.3.0

Event History

Sep 11, 2026

CVE Published

via OSV·04:33 PM

Data Sourced

via OSV·04:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper versions 3.3.0 through 4.2.0 are exposed if an actor can write to the shared cache infrastructure. Hosts that read cached query results may disclose sensitive local files, including stored database and IAM role credentials.

What does an attacker need to exploit it?

The attacker needs write access to the shared cache infrastructure and must place crafted XML data in a cached column value. No additional user interaction is required.

What should teams do if they are running an affected version?

Upgrade the AWS Advanced JDBC Wrapper to version 4.3.0 or later. If upgrading cannot happen immediately, restrict and review write access to the shared cache infrastructure to prevent untrusted parties from inserting crafted cached values.

How can teams determine whether they are affected?

Check whether the application uses the RemoteQueryCachePlugin and is running AWS Advanced JDBC Wrapper version 3.3.0 through 4.2.0. Also identify whether the shared cache infrastructure permits write access by actors who should not be trusted to supply cached query-result data.

GHSA-fpvp-qwgm-v6h9: Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What should teams do if they are running an affected version?

How can teams determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What should teams do if they are running an affected version?

How can teams determine whether they are affected?