CVE-2026-113582: Apache Abdera 0 through *

Affected technology

Apache Abdera · 0 through *
Apache Software Foundation

Apache Abdera · cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2 through *
Apache Software Foundation

Component: Not specified by the source
Function: org.apache.abdera.parser.stax.FOMParser.parse, org.apache.abdera.protocol.server.adapters.ibatis.IBatisCollectionAdapter.parseContent
File: parser/src/main/java/org/apache/abdera/parser/stax/FOMParser.java, adapters/jdbc/src/main/java/org/apache/abdera/protocol/server/adapters/ibatis/IBatisCollectionAdapter.java

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says uNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.