Live › vulnerability › CVE-2026-119724
Apache JClouds, a retired Java library for cloud APIs, does not limit recursive entity references in XML DTDs. An attacker who can send crafted XML to an application using it can exhaust memory or CPU.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
Applications that use Apache JClouds and parse XML that outside parties can send to them are exposed. The sources state the project is retired and the issue affects all versions, with no planned fix. Teams not using JClouds, or not feeding it untrusted XML, can skip it.
No product ranges from the sources yet.
jclouds in your Java dependencies (for example pom.xml or build.gradle) and note the version in useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.
This issue affects Apache JClouds: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · in your agent: get_signal("CVE-2026-119724")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.