CVE-2026-92877

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.

CWE	CWE-611
Vendor	eclipse foundation
Product	jaxb-ri (core)
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation jaxb-ri (core)

Be the first to know when new unknown vulnerabilities affecting eclipse foundation jaxb-ri (core) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / jaxb-ri (core)

4.0.4 4.0.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-ee4j/jaxb-ri/pull/2013 gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/310

Credits

Huzaifa Sidhpurwala (Red Hat Lightwell project)