Description
Checkstyle before 8.18 loads external DTDs by default.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | checkstyle | 8.26-1 | — |
| Debian 13 | checkstyle | 8.26-1 | — |
| Debian 12 | checkstyle | 8.26-1 | — |
| Debian 8 | checkstyle | 5.9-1+deb8u1 | DLA-1768-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | checkstyle | No fix yet | — |
| Ubuntu 16.04 LTS | checkstyle | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.puppycrawl.tools:checkstyle | < 8.18 | 8.18 | GHSA-gp32-7h29-rpxm |
Advisories 1
- DLA-1768-1 checkstyle - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/checkstyle/checkstyle/pull/6476
- https://github.com/checkstyle/checkstyle/issues/6474
- https://github.com/checkstyle/checkstyle/issues/6478
- https://checkstyle.org/releasenotes.html#Release_8.18
- [james-server-dev] 20190318 [james-project] 01/03: JAMES-2693 Update com.puppycrawl.tools:checkstyle to respond to CVE-2019-9658 mailing-list
- FEDORA-2019-a3f67e2364 vendor-advisory
- FEDORA-2019-e4405b4c9f vendor-advisory
- [debian-lts-announce] 20190428 [SECURITY] [DLA 1768-1] checkstyle security update mailing-list
- FEDORA-2019-4696630d6f vendor-advisory
- [accumulo-notifications] 20190612 [GitHub] [accumulo-testing] milleruntime opened a new pull request #80: Update checkstyle mailing-list
- [fluo-notifications] 20190814 [GitHub] [fluo] ctubbsii merged pull request #1073: Update checkstyle (CVE-2019-9658) mailing-list
- [fluo-commits] 20190814 [fluo] branch fluo-parent updated: Update checkstyle (CVE-2019-9658) (#1073) mailing-list
- [fluo-notifications] 20190815 Build failed in Jenkins: Fluo Parent Pom #101 mailing-list
- [nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html mailing-list