CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-119724: Apache JClouds: XML External Entity (XXE) in provider-response parsing

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 12115

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-119724: Apache JClouds: XML External Entity (XXE) in provider-response parsing

CVE-2026-119724 describes an XML external entity (XXE) vulnerability in Apache JClouds affecting all versions, caused by improper restriction of recursive entity references in document type definitions. The Apache JClouds project is retired and will not receive a fix, leaving users to seek alternatives or implement access restrictions.

Why it matters: Organizations running Apache JClouds must evaluate alternative cloud abstraction libraries or apply network-level access controls, as the project maintainers will not patch this moderate-severity vulnerability.

CVEsCVE-2026-119724
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary