Executive brief
Eclipse RDF4J is a Java library for working with RDF (Resource Description Framework) semantic data. Multiple XML parsing entry points in the library did not fully restrict XML External Entity (XXE) processing, allowing attackers to submit specially crafted XML to read sensitive files, cause denial of service, or trigger server-side requests when parsing untrusted RDF data or query results.
Technical details
The vulnerability is an XML External Entity (XXE) injection flaw (CWE-611, CWE-827) affecting multiple XML parser entry points in Eclipse RDF4J versions before 5.3.2. The root cause is an incomplete fix for CVE-2018-1000644; the earlier patch did not cover all parser code paths, including those used for RDF/XML parsing, TriX format, SPARQL/XML results, DOM helper functions, transaction XML parsing, and server boot configuration. An attacker can submit specially crafted XML containing DOCTYPE declarations and external entity references to any application parsing untrusted RDF data, potentially disclosing confidential data, causing denial of service, or making unauthorized server-side requests. The vulnerability requires no authentication or user interaction and is exploitable over the network. RDF4J 5.3.2 fixes the issue by rejecting DOCTYPE declarations, disabling external entities, and blocking external DTD loading by default across all parser entry points.
Affected products
- Eclipse RDF4J before 5.3.2
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: RDF4J 5.3.2 released