---
id: "CVE-2026-119724"
kind: "vulnerability"
aliases: ["CVE-2026-119724"]
title: "Apache JClouds: unrestricted XML entity expansion in DTD parsing"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-jclouds", "java", "package", "xml"]
not_affected_if: ["not-using-jclouds", "trusted-input-only"]
published_at: "2026-11-03T10:17:15+00:00"
first_seen_at: "2026-11-03T10:20:15+00:00"
updated_at: "2026-11-03T10:20:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119724", "first_seen_at": "2026-11-03T10:20:15+00:00"}]
---

# Apache JClouds: unrestricted XML entity expansion in DTD parsing

Apache JClouds, a retired Java library for cloud APIs, does not limit recursive entity references in XML DTDs. An attacker who can send crafted XML to an application using it can exhaust memory or CPU.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `jclouds` in your Java dependencies (for example `pom.xml` or `build.gradle`) and note the version in use
- Check whether any service you run parses XML supplied by untrusted callers through JClouds

## Fix

- Apache JClouds: no fixed version; the project is retired and the sources say users should find an alternative or restrict access to trusted users

## Timeline

- 2026-11-03T10:20:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119724

## From the sources

** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.



This issue affects Apache JClouds: all versions.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_