CVE-2025-4949: Eclipse JGit XML External Entity (XXE) Vulnerability
Summary
CVE-2025-4949: Eclipse JGit XML External Entity (XXE) Vulnerability. Affects org.eclipse.jgit:org.eclipse.jgit across 4 version ranges.
< 6.10.1.202505221210-r
>= 7.0.0.202409031743-r, < 7.0.1.202505221510-r
>= 7.1.0.202411261347-r, < 7.1.1.202505221757-r
>= 7.2.0.202503040940-r, < 7.2.1.202505142326-r
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jgit · Debian:11
The same CVE-2025-4949 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse JGit is a Java implementation of the Git version control system, designed to provide a lightweight and efficient way to manage Git repositories. It is widely used in various applications for its ability to handle Git operations programmatically. However, certain versions of JGit have been found to be vulnerable to XML External Entity (XXE) attacks, which can compromise the security of applications utilizing this library.
Vulnerability Detail
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class and the AmazonS3 class are susceptible to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues, as attackers can exploit the XML parsing process to access sensitive data or disrupt service.
How To Fix
Latest published version: 7.8.0.202609011348-r as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.10.1.202505221210-r6.10.1.202505221210-r -
>= 7.0.0.202409031743-r, < 7.0.1.202505221510-r7.0.1.202505221510-r -
>= 7.1.0.202411261347-r, < 7.1.1.202505221757-r7.1.1.202505221757-r -
>= 7.2.0.202503040940-r, < 7.2.1.202505142326-r7.2.1.202505142326-r
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling XML parsing features that allow external entities. This can be done by configuring the XML parser to disallow DTDs and external entities, though this may require custom code adjustments.
Conclusion
The Eclipse JGit XML External Entity (XXE) vulnerability (CVE-2025-4949) poses significant risks to applications using affected versions of the library. It is crucial to update to the patched version to mitigate these risks and ensure the security of your software.
See every vulnerability recorded for org.eclipse.jgit:org.eclipse.jgit →
FAQ
An XXE attack occurs when an XML parser processes external entities within XML documents, potentially allowing attackers to access sensitive files or execute arbitrary code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability can lead to data breaches, service disruptions, and exploitation of sensitive information, posing significant risks to your application and its users.
Yes, you can implement workarounds such as disabling external entity processing in your XML parser configuration to reduce the risk until you can upgrade.
It is recommended to regularly check for vulnerabilities, ideally as part of your continuous integration/continuous deployment (CI/CD) pipeline, to ensure your software remains secure.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jgit:org.eclipse.jgit.
