Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Summary
Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Original description
The description as published by the source.
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-53689 jackrabbit
- Ubuntu UBUNTU-CVE-2025-53689 jackrabbit
References
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com