{"id":"CVE-2026-119724","kind":"vulnerability","aliases":["CVE-2026-119724"],"related":[],"title":"Apache JClouds: unrestricted XML entity expansion in DTD parsing","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.\n\n\n\nThis issue affects Apache JClouds: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","summary":"Apache JClouds, a retired Java library for cloud APIs, does not limit recursive entity references in XML DTDs. An attacker who can send crafted XML to an application using it can exhaust memory or CPU.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-jclouds","java","package","xml"],"not_affected_if":["not-using-jclouds","trusted-input-only"],"how_to_check":"- Look for `jclouds` in your Java dependencies (for example `pom.xml` or `build.gradle`) and note the version in use\n- Check whether any service you run parses XML supplied by untrusted callers through JClouds","fix":"- Apache JClouds: no fixed version; the project is retired and the sources say users should find an alternative or restrict access to trusted users","status":"open","published_at":"2026-11-03T10:17:15+00:00","first_seen_at":"2026-11-03T10:20:15+00:00","triaged_at":"2026-11-03T10:20:44+00:00","updated_at":"2026-11-03T10:20:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T10:20:44Z","model":"claude-haiku-5-5","output":{"fix":"- Apache JClouds: no fixed version; the project is retired and the sources say users should find an alternative or restrict access to trusted users","reach":"network","title":"Apache JClouds: unrestricted XML entity expansion in DTD parsing","impact":"low","summary":"Apache JClouds, a retired Java library for cloud APIs, does not limit recursive entity references in XML DTDs. An attacker who can send crafted XML to an application using it can exhaust memory or CPU.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-jclouds","xml"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Service becomes unresponsive through memory or CPU exhaustion","analyst_note":"Confirm which XML entry points in JClouds are reachable and whether any maintained fork or replacement exists; the NVD entry gives no details beyond the description.","how_to_check":"- Look for `jclouds` in your Java dependencies (for example `pom.xml` or `build.gradle`) and note the version in use\n- Check whether any service you run parses XML supplied by untrusted callers through JClouds","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-jclouds","trusted-input-only"],"who_is_affected":"Applications that use Apache JClouds and parse XML that outside parties can send to them are exposed. The sources state the project is retired and the issue affects all versions, with no planned fix. Teams not using JClouds, or not feeding it untrusted XML, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000709,"input_tokens":4198,"output_tokens":578,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119724':12A,15A '-2026':11A,14A 'access':108C 'affect':77C,119C 'altern':105C 'apach':1A,17B,22B,73C,78C 'apache-jcloud':16B 'api':30B 'applic':49B 'assign':59C 'attack':41B 'cloud':29B 'cpu':56B 'craft':45B 'cve':10A,13A 'dtd':8A 'dtds':39B,67C 'entiti':5A,35B,64C,69C 'exhaust':53B 'expans':6A,70C 'find':103C 'fix':96C 'improp':60C 'instanc':111C 'issu':76C,98C 'java':19B,26B 'jcloud':2A,18B,23B,74C,79C 'librari':27B 'limit':33B 'longer':124C 'maintain':128C 'memori':54B 'note':115C 'packag':20B 'pars':9A 'plan':90C 'product':120C 'project':84C 'recommend':101C 'recurs':34B,63C 'refer':36B,65C 'releas':92C 'restrict':61C,107C 'retir':25B,86C 'send':44B 'support':125C 'trust':113C 'unrestrict':3A 'unsupport':57C 'use':50B 'user':99C,114C 'version':81C,94C 'vulner':71C,117C 'xml':4A,21B,38B,46B,68C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Apache JClouds and parse XML that outside parties can send to them are exposed. The sources state the project is retired and the issue affects all versions, with no planned fix. Teams not using JClouds, or not feeding it untrusted XML, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejclouds","java","low","package","xml"],"first_public_at":"2026-11-03T10:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119724","severity":null,"published_at":"2026-11-03T10:17:15+00:00","modified_at":"2026-11-03T10:17:15+00:00","first_seen_at":"2026-11-03T10:20:15+00:00","fetched_at":"2026-11-03T10:20:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}