Skip to content
OpenAdvisories
Medium · 6.8 CVE-2025-4949 EUVD-2025-15988GHSA-vrpq-qp53-qv56

XXE vulnerability in Eclipse JGit

Published May 21, 2025 · Updated Oct 14, 2025 · Assigned by eclipse

Vendor: Eclipse JGit Product: Eclipse JGit Package: apache-nifi-registry Package: apache-nifi-registry-toolkit Package: apicurio-registry Package: apicurio-registry-nginx-config Package: apicurio-registry-ui Package: gradle-8 Package: gradle-stage0 Package: jgit Package: jgit Package: nextflow Package: nextflow-compat Package: org.eclipse.jgit:org.eclipse.jgit Package: sonarqube-10 Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: wildfly Package: wildfly-openjdk-17 Package: wildfly-openjdk-17-compat Package: wildfly-openjdk-21 Package: wildfly-openjdk-21-compat Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Affected products

VendorProductAffectedFixed
Eclipse JGit Eclipse JGit 7.2.0 – < 7.2.1.202505142326-r, 7.1.0 – < 7.1.1.202505221757-r, 7.0.0 – < 7.0.1.202505221510-r, < 5.13.4.202507202350-r, 6.0.0 – < 6.10.1.202505221210-r 7.2.1.202505142326-r

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jgit 7.7.1-1 —
Debian 13 jgit No fix yet —
Debian 12 jgit No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jgit No fix yet —
Ubuntu 26.04 LTS jgit No fix yet —
Ubuntu 25.10 jgit No fix yet —
Ubuntu 24.04 LTS jgit No fix yet —
Ubuntu 22.04 LTS jgit No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS jgit No fix yet —
Ubuntu 18.04 LTS jgit No fix yet —
Ubuntu 16.04 LTS jgit No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-cxf +3 3.4.10-3.SP2_redhat_00003.1.el7eap RHSA-2026:6011
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-eclipse-jgit 5.13.5.202508271544-1.r_redhat_00001.1.el7eap RHSA-2026:6011
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-hibernate +4 5.3.38-1.Final_redhat_00001.1.el7eap RHSA-2026:6011
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jbossws-cxf 5.3.0-2.SP1_redhat_00002.1.el7eap RHSA-2026:6011
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 2.0.41-7.SP8_redhat_00001.1.el7eap RHSA-2026:6011
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +4 7.3.17-5.GA_redhat_00006.1.el7eap RHSA-2026:6011
Red Hat Jboss Enterprise Application Platform Els 7 eap7-apache-cxf +3 3.5.11-1.SP1_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-eclipse-jgit 5.13.5.202508271544-2.r_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-hibernate +4 5.3.38-1.Final_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-marshalling +1 2.0.16-1.Final_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-netty +26 4.1.124-1.Final_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-undertow 2.2.39-1.Final_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly +4 7.4.24-4.GA_redhat_00002.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly-java-jdk17 7.4.24-4.GA_redhat_00002.1.el8eap RHSA-2026:4917, RHSA-2026:4916
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.40.0-3.redhat_00008.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-angus-activation 2.0.2-2.redhat_00002.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-antlr4 +1 4.13.2-1.redhat_00001.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-apache-commons-io 2.16.1-2.redhat_00002.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-apache-commons-lang 3.18.0-2.redhat_00003.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-atinject 2.0.1-5.redhat_00007.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.82.0-1.redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.11.0-1.GA_redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-eclipse-jgit 6.10.1.202505221210-1.r_redhat_00002.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-hal-console 3.6.27-1.Final_redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-hibernate +2 6.2.46-1.Final_redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-hibernate-search +6 7.2.4-1.Final_redhat_00001.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-hibernate-validator +1 8.0.2-1.Final_redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773
Red Hat JBoss EAP 8 eap8-httpcomponents-client 4.5.14-5.redhat_00016.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-httpcomponents-core 4.4.16-6.redhat_00011.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-infinispan +19 15.0.21-1.Final_redhat_00002.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-installation-manager-api 1.0.3-1.Final_redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773
Red Hat JBoss EAP 8 eap8-jakarta-activation 2.1.3-2.redhat_00002.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jakarta-annotation-api 2.1.1-5.redhat_00005.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jakarta-enterprise-concurrent 3.0.2-1.redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773
Red Hat JBoss EAP 8 eap8-jakarta-interceptor-api 2.1.0-5.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jakarta-mail 2.1.3-3.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jakarta-servlet-api 6.0.0-6.redhat_00007.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jakarta-validation-api 3.0.2-3.redhat_00006.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jakarta-ws-rs-api 3.1.0-5.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.2-2.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jboss-el-api_5.0_spec 4.0.2-1.Final_redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.3.6-1.Final_redhat_00001.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jctools +1 4.0.5-3.redhat_00002.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-jgroups 1:5.3.21-1.Final_redhat_00001.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-objectweb-asm +1 9.7.1-3.redhat_00002.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-parsson 1.1.7-3.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-reactive-streams 1.0.4-4.redhat_00005.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-reactivex-rxjava2 2.2.21-4.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-saaj-impl 3.0.4-2.redhat_00002.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-snakeyaml 2.3.0-1.redhat_00002.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-stax-ex 2.1.0-3.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-stax2-api 4.2.2-2.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-sun-istack-commons +2 4.1.2-2.redhat_00003.1.el8eap RHSA-2025:22775, RHSA-2025:22773
Red Hat JBoss EAP 8 eap8-wildfly +4 8.0.11-1.GA_redhat_00002.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188
Red Hat JBoss EAP 8 eap8-wildfly-clustering +19 5.0.11-1.Final_redhat_00001.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.2.12-1.Final_redhat_00002.1.el8eap RHSA-2025:22775, RHSA-2025:22773
Red Hat JBoss EAP 8 eap8-wildfly-http-client +4 2.1.3-1.Final_redhat_00001.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-wildfly-javadocs 8.1.1-2.GA_redhat_00006.1.el8eap RHSA-2025:22188, RHSA-2025:22187
Red Hat JBoss EAP 8 eap8-yasson 3.0.4-2.redhat_00004.1.el8eap RHSA-2025:22775, RHSA-2025:22773, RHSA-2025:22188

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 jgit 5.11.0-150200.3.23.1 SUSE-SU-2025:02762-1
SLES 15 SP6 jgit 5.11.0-150200.3.23.1 SUSE-SU-2025:02762-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed jgit 5.11.0-2.1 openSUSE-SU-2025:15232-1
openSUSE Leap 15.6 eclipse-jgit 5.11.0-150200.3.23.1 SUSE-SU-2025:02762-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apache-nifi-registry +1 2.4.0-r1 —
Wolfi rolling apicurio-registry +2 3.0.7-r1 —
Wolfi rolling gradle-8 8.14.1-r1 —
Wolfi rolling gradle-stage0 No fix yet —
Wolfi rolling nextflow +1 25.04.2-r1 —
Wolfi rolling sonarqube-10 25.5.0.107428-r1 —
Wolfi rolling thingsboard +4 4.0.1-r2 —
Wolfi rolling wildfly +4 36.0.1-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.eclipse.jgit:org.eclipse.jgit >= 7.2.0.202503040940-r, < 7.2.1.202505142326-r 7.2.1.202505142326-r GHSA-vrpq-qp53-qv56
Maven org.eclipse.jgit:org.eclipse.jgit >= 7.1.0.202411261347-r, < 7.1.1.202505221757-r 7.1.1.202505221757-r GHSA-vrpq-qp53-qv56
Maven org.eclipse.jgit:org.eclipse.jgit >= 7.0.0.202409031743-r, < 7.0.1.202505221510-r 7.0.1.202505221510-r GHSA-vrpq-qp53-qv56
Maven org.eclipse.jgit:org.eclipse.jgit >= 6.1.0.202203080745-r, < 6.10.1.202505221210-r 6.10.1.202505221210-r GHSA-vrpq-qp53-qv56
Maven org.eclipse.jgit:org.eclipse.jgit >= 6.0.0.202110060947-m1, < 6.0.0.202111291000-r 6.0.0.202111291000-r GHSA-vrpq-qp53-qv56
Maven org.eclipse.jgit:org.eclipse.jgit < 5.13.4.202507202350-r 5.13.4.202507202350-r GHSA-vrpq-qp53-qv56

Advisories 17

References