CVE-2022-46751: Apache Ivy External Entity Reference vulnerability
Summary
CVE-2022-46751: Apache Ivy External Entity Reference vulnerability. Affects org.apache.ivy:ivy versions < 2.5.2. Fixed in 2.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Ivy is a popular dependency management tool used in conjunction with Apache Ant. It allows developers to manage project dependencies and resolve conflicts between different versions of libraries. This vulnerability affects all versions of Apache Ivy prior to 2.5.2. Apache Ivy parses XML files, including its own configuration, Ivy files, and Apache Maven POMs. It allows downloading external document type definitions (DTDs) and expands any entity references contained within them. This can lead to data exfiltration, unauthorized access to resources, or disruption of Ivy's execution.
Vulnerability Detail
The vulnerability arises from the improper restriction of XML External Entity Reference and XML Injection (Blind XPath Injection) in Apache Ivy. Prior to version 2.5.2, Ivy allows the downloading of external DTDs and expands entity references within them. This can be exploited to perform various malicious activities, such as exfiltrating sensitive data, accessing restricted resources, or disrupting Ivy's functionality. Starting from Ivy 2.5.2, DTD processing is disabled by default, except when parsing Maven POMs. Users of earlier versions can restrict external DTD processing using Java system properties.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Apache Ivy 2.5.2 is not feasible at the moment, you can apply a workaround by restricting the processing of external DTDs using Java system properties. Please refer to the 'JAXP Properties for External Access restrictions' section in Oracle's 'Java API for XML Processing (JAXP) Security Guide' for detailed instructions on how to set these properties.
Conclusion
The Apache Ivy External Entity Reference vulnerability (CVE-2022-46751) affects all versions of Apache Ivy prior to 2.5.2. It allows the downloading of external DTDs and expands entity references, which can lead to various security risks. To mitigate this vulnerability, it is recommended to upgrade to Apache Ivy 2.5.2 or later. Alternatively, you can restrict external DTD processing using Java system properties. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ivy:ivy →
FAQ
Apache Ivy is a dependency management tool used in conjunction with Apache Ant. It helps manage project dependencies and resolve conflicts between different versions of libraries.
All versions of Apache Ivy prior to 2.5.2 are affected by this vulnerability.
This vulnerability can be exploited to exfiltrate data, access restricted resources, or disrupt the execution of Apache Ivy.
To fix this vulnerability, it is recommended to upgrade to Apache Ivy version 2.5.2 or later. Alternatively, you can restrict the processing of external DTDs using Java system properties.
You can find more information about this vulnerability in the official Apache Ivy documentation or by referring to the CVE identifier CVE-2022-46751.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ivy:ivy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
