CVE-2021-23926: Improper Restriction of Recursive Entity References in Apache XMLBeans
Summary
CVE-2021-23926: Improper Restriction of Recursive Entity References in Apache XMLBeans. Affects org.apache.xmlbeans:xmlbeans versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Also tracked for
- xmlbeans · Debian:11
The same CVE-2021-23926 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache XMLBeans is a Java-based framework that provides tools for working with XML data. It allows developers to create, manipulate, and validate XML documents using a simple API. XMLBeans up to version 2.6.0 is affected by a vulnerability that arises from improper restriction of recursive entity references. The XML parsers used by XMLBeans did not set the necessary properties to protect against malicious XML input, making it vulnerable to XML Entity Expansion attacks.
Vulnerability Detail
The vulnerability in XMLBeans allows an attacker to exploit XML Entity Expansion attacks. By crafting a malicious XML input, an attacker can cause the XML parser to recursively expand entities, leading to excessive memory consumption and potential denial-of-service (DoS) conditions. This can result in resource exhaustion, system instability, or even complete system compromise. The vulnerability affects XMLBeans up to and including version 2.6.0.
How To Fix
Latest published version: 5.4.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of XMLBeans to address the issue effectively.
Conclusion
The vulnerability in Apache XMLBeans up to version 2.6.0 exposes applications to XML Entity Expansion attacks, which can lead to resource exhaustion, system instability, or even complete system compromise. To mitigate this vulnerability, it is crucial to upgrade to XMLBeans version 3.0.0 or later. Developers should promptly update their projects and dependencies to ensure a secure XML parsing environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.xmlbeans:xmlbeans →
FAQ
XML Entity Expansion is a technique where an attacker exploits the ability of XML parsers to recursively expand entities. By crafting a malicious XML input with nested entity references, the attacker can cause the parser to consume excessive memory and potentially lead to denial-of-service conditions.
This vulnerability can result in resource exhaustion, system instability, or even complete system compromise. An attacker can exploit the vulnerability to launch denial-of-service attacks, consume system resources, and potentially execute arbitrary code.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to address the vulnerability promptly by upgrading to the fixed version to mitigate any potential risks.
No, only XMLBeans up to and including version 2.6.0 are affected by this vulnerability. It is recommended to upgrade to version 3.0.0 or later to ensure a secure XML parsing environment.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
