CVE-2026-111252: OpenNMS Meridian and Horizon XML entity expansion denial of service

CVE-2026-111252 · Severity: medium · CVSS 6.5 · Published 2026-10-15

OpenNMS Meridian and Horizon are network monitoring and management platforms. A denial of service vulnerability in XML parsing allows an authenticated user with provisioning access to submit specially crafted XML documents that exhaust server memory, causing the monitoring system to become unavailable. This affects administrators and operations teams who depend on the platform for network visibility.

Technologies: OpenNMS Horizon, OpenNMS Meridian. Vendors: OpenNMS.

Quick answers

Is CVE-2026-111252 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111252 being exploited in the wild.
How severe is CVE-2026-111252?
Medium severity, with a CVSS score of 6.5, published 15 October 2026.
Which products and versions are affected?
OpenNMS Horizon versions before 36.0.5; OpenNMS Meridian versions before 2024.3.14, 2025.0.11, 2026.0.1.
Is there a fix for CVE-2026-111252?
Yes: fixed in Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Until then: If immediate upgrade is not possible, set the system property org.opennms.provision.requisition.allowDoctype to true only for backward compatibility with existing requisitions that contain DOCTYPE, but remove DOCTYPE from those requisitions as soon as practical to restore protection. Additionally, ensure OpenNMS installations remain on private networks and are not directly accessible from the Internet, as documented in installation guidance. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111252 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-111252?
Check whether you run OpenNMS Horizon or OpenNMS Meridian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer

If immediate upgrade is not possible, set the system property org.opennms.provision.requisition.allowDoctype to true only for backward compatibility with existing requisitions that contain DOCTYPE, but remove DOCTYPE from those requisitions as soon as practical to restore protection. Additionally, ensure OpenNMS installations remain on private networks and are not directly accessible from the Internet, as documented in installation guidance.

Technical details

The Xerces XML parser in OpenNMS had no effective limit on entity expansion, allowing DOCTYPE declarations with nested or large internal entities to cause memory exhaustion. An authenticated user with provisioning access can trigger the vulnerability by importing a requisition or foreign-source document with a remote URL, or by directly submitting malicious XML. The fix caps entity expansion limits and rejects DOCTYPE declarations in requisition and foreign-source XML.

Affected products

  • OpenNMS Meridian versions before 2024.3.14, 2025.0.11, 2026.0.1
  • OpenNMS Horizon versions before 36.0.5

Timeline

  • 2026-10-15: disclosed
  • 2026-09-28: patched: Entity expansion limit capping merged
  • 2026-10-09: patched: DOCTYPE rejection in requisition and foreign-source XML merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.