Apache Abdera: XML external entity expansion in Atom parsing
Summary
Apache Abdera, a retired Java library for Atom feed parsing, does not restrict external XML entity references. An attacker who can supply XML that an application parses with Abdera may be able to read sensitive data or trigger server-side requests. The CVE record states that all versions are affected and that no fixed version will be released because the project is retired.
Affected
- Apache Abdera, all versions (per the CVE text)
- Maven artifacts abdera-parser and abdera-jdbc
- The CNA product data also lists a commit-based range starting at cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2; this could not be reconciled with the "all versions" statement
Fixed in
- None. Apache Abdera is retired and no fix will be released.
Workaround
- Keep untrusted XML away from the affected Abdera parser and JDBC adapter parsing paths.
- Disable external entity and DTD processing in the XML parser configuration of applications that still use Abdera (not verified against Abdera's parser settings; test first).
Exploitation
- Known exploited: no, according to the sources reviewed.
- EPSS: 0.00463 (low predicted exploitation probability).
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- A public exploit listing exists but has not been verified.
Our recommendation
- Check whether Java applications or dependency trees contain abdera-parser or abdera-jdbc.
- Plan migration to a maintained Atom or XML parsing library.
- Until migration, block untrusted XML input to affected code paths and disable external entity processing.
- Monitor for vendor or downstream updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Attic: Apache Abdera attic.apache.org
- Apache lists thread lists.apache.org
- oss-security post www.openwall.com
- Tenable CVE page www.tenable.com
- HOL Guard CVE page hol.org
- Strix CVE page www.strix.ai
- ThreatInt CVE page cve.threatint.com
- Apache security-site pull request 125 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:44.
Original description (NVD)
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.