CVE-2026-92877
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature al…
Published: 2026-10-12 · CVSS: 8.3 · CVSS 4.0
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7