Description
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache XMLBeans | Apache XMLBeans – ≤ 2.6.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xmlbeans | 3.0.2-1 | — |
| Debian 13 | xmlbeans | 3.0.2-1 | — |
| Debian 12 | xmlbeans | 3.0.2-1 | — |
| Debian 9 | xmlbeans | 2.6.0+dfsg-1+deb9u1 | DLA-2693-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | xmlbeans | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| SLES 15 SP3 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| SLES 15 SP2 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| SLES 12 SP5 | xmlbeans | 2.6.0-3.3.1 | SUSE-SU-2022:3876-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP2 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| SLE HPC 15 SP2 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| SUSE Manager Server 4.1 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| SUSE Manager Retail Branch Server 4.1 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| SUSE Manager Proxy 4.1 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| SUSE Enterprise Storage 7 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
| openSUSE Leap 15.3 | xmlbeans | 2.6.0-150000.5.3.1 | SUSE-SU-2022:3875-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.xmlbeans:xmlbeans | < 3.0.0 | 3.0.0 | GHSA-mw3r-pfmg-xp92 |
Advisories 10
- DLA-2693-1 xmlbeans - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:3876-1 Security update for xmlbeans SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3875-1 Security update for xmlbeans SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2026-0028 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- NCSC-2025-0028 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2024-0068 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- NCSC-2024-0299 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-0156 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2024
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
References
- https://poi.apache.org/
- https://issues.apache.org/jira/browse/XMLBEANS-517
- [axis-java-dev] 20210312 xmlbeans 2.6.0 and CVE-2021-23926 mailing-list
- [axis-java-dev] 20210312 Re: xmlbeans 2.6.0 and CVE-2021-23926 mailing-list
- [debian-lts-announce] 20210628 [SECURITY] [DLA 2693-1] xmlbeans security update mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210513-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html