[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260112121353.1a1921f1@hboeck.de>
Date: Mon, 12 Jan 2026 12:13:53 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-68493: Apache Struts: XXE vulnerability
in outdated XWork component
Looking through recent mails on this list with XXE in the toppic, I see:
* XXE in Apache Struts due to insecure defaults in Java's standard
library: CVE-2025-68493
* XXE in Apache SIS due to insecure defaults in Java's standard
library: CVE-2025-68280
* XXE in Apache Tika due to insecure defaults in Java's standard
library: CVE-2025-54988, CVE-2025-66516
* XXE in Apache Jackrabbit due to insecure defaults in Java's standard
library: CVE-2025-53689
* XXE in Apache Ambari due to insecure defaults in Java's standard
library: CVE-2025-23195
* XXE in Apache XML Graphics FOP due to insecure defaults in Java's
standard library: CVE-2024-28168
* XXE in Apache Drill due to insecure defaults in Java's standard
library: CVE-2023-48362
Also recently: my research on prevalent XXEs in electronic invoicing
software, largely due to insecure defaults in Java and Saxon (which is
based on Java): https://invoice.secvuln.info/
I'm sensing a pattern here. Maybe Apache should audit all their uses of
Apache's XML standard library. And, maybe, having insecure defaults in
Java's standard library is not so great.
--
Hanno Böck - Independent security researcher
https://itsec.hboeck.de/
https://badkeys.info/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
