CVE-2022-28890: XML External Entity Reference in Apache Jena

org.apache.jena:jena Updated 02 Oct 2025

Summary

06/05/2022

Disclosed on

CVE-2022-28890

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2022-28890: XML External Entity Reference in apache jena. Affects org.apache.jena:jena versions >= 4.4.0, < 4.5.0. Fixed in 4.5.0. How to fix ↓

Also tracked for

apache-jena · Debian:12

The same CVE-2022-28890 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Jena is an open-source Java framework for building Semantic Web and Linked Data applications. It provides a set of APIs and tools for working with RDF (Resource Description Framework) data. The vulnerability in Apache Jena version 4.4.0 and prior versions allows an attacker to exploit the RDF/XML parser and retrieve external DTD (Document Type Definition) files. This can lead to various security risks, including information disclosure and potential remote code execution.

Vulnerability Detail

The vulnerability arises from the lack of proper validation and handling of external entities in the RDF/XML parser of Apache Jena. By crafting a malicious XML file, an attacker can trigger the parser to fetch and process external DTD files, which may contain sensitive information or malicious code. This issue has been assigned a CVSS score of 9.8, indicating its critical severity. It affects Apache Jena versions 4.4.0 and earlier, while versions 4.2.x and 4.3.x are not vulnerable.

How To Fix

Minimum fixed version

4.5.0

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to Apache Jena version 4.5.0 or later.

Conclusion

The XML External Entity Reference vulnerability in Apache Jena can be exploited by attackers to retrieve external DTD files, leading to potential information disclosure and remote code execution. It is crucial to upgrade to Apache Jena version 4.5.0 or later to mitigate this vulnerability. For further assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.jena:jena →