medium 5.3

CVE-2025-4949 json

XXE vulnerability in Eclipse JGit

published 2025-05-21 17 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-15988 , GHSA-vrpq-qp53-qv56

cvss: 5.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits: 0; none known

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Patch / fix

fixed in 2 distros 3

maven org.eclipse.jgit:org.eclipse.jgit 5.13.4.202507202350-r, 6.0.0.202111291000-r, 6.10.1.202505221210-r, 7.0.1.202505221510-r, 7.1.1.202505221757-r, 7.2.1.202505142326-r
Eclipse JGit Eclipse JGit 5.13.4.202507202350-r, 6.10.1.202505221210-r, 7.0.1.202505221510-r, 7.1.1.202505221757-r, 7.2.1.202505142326-r

red hat suse opensuse

eap8-yasson jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 3.0.4-2.redhat_00004.1.el8eap
eap8-jctools jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 4.0.5-3.redhat_00002.1.el8eap
eap8-parsson jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 1.1.7-3.redhat_00003.1.el8eap
eap8-stax-ex jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 2.1.0-3.redhat_00003.1.el8eap
eap8-wildfly jboss enterprise application platform 8.0 8.0.11-1.GA_redhat_00002.1.el8eap
eap8-atinject jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 2.0.1-5.redhat_00007.1.el8eap
eap8-hibernate jboss enterprise application platform 8.0 6.2.46-1.Final_redhat_00001.1.el8eap
eap8-saaj-impl jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 3.0.4-2.redhat_00002.1.el8eap

red hat advisories RHSA-2026:6011 RHSA-2026:4916 RHSA-2026:4917 RHSA-2026:4915 RHSA-2025:22773 RHSA-2025:22775

eclipse-jgit openSUSE Leap 15.6 5.11.0-150200.3.23.1
jgit SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6 5.11.0-150200.3.23.1

suse advisories SUSE-SU-2025:02762-1

jgit openSUSE Tumbleweed 5.11.0-2.1

opensuse advisories openSUSE-SU-2025:15232-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-4949 updated 2026-11-07 cvss 4.8

org.eclipse.jgit: XXE vulnerability in Eclipse JGit

Red Hat A-MQ Clients 2 org.eclipse.jgit Red Hat Cryostat 3 org.eclipse.jgit Red Hat Logging Subsystem for Red Hat OpenShift org.eclipse.jgit Red Hat OpenShift Developer Tools and Services jenkins-rhel9 Red Hat build of Apicurio Registry 2 org.eclipse.jgit Red Hat build of Apicurio Registry 3 org.eclipse.jgit
affected: workaround, no fix available
Red Hat Fuse 7 org.eclipse.jgit
affected: workaround, no fix planned “Will not fix”
Red Hat Integration Camel K 1 org.eclipse.jgit Red Hat JBoss Enterprise Application Platform 7 org.eclipse.jgit
affected: workaround, no fix available
Red Hat Process Automation 7 org.eclipse.jgit
affected: workaround, no fix planned “Will not fix”
Red Hat streams for Apache Kafka org.eclipse.jgit
affected: workaround, no fix available
Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4 v4.13.0-1765819949
fixed: vendor fix RHSA-2025:23487
Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4 v4.13.0-1765819949
fixed: vendor fix RHSA-2025:23482
Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4 v4.14.0-1765820005
fixed: vendor fix RHSA-2025:23485

show 19 more

Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4 v4.14.0-1765820005
fixed: vendor fix RHSA-2025:23486
Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4 v4.17.0-1765868606
fixed: vendor fix RHSA-2025:23490
Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4 v4.17.0-1765868606
fixed: vendor fix RHSA-2025:23489
Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4 v4.17.0-1765868606
fixed: vendor fix RHSA-2025:23492
Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4 v4.17.0-1765868606
fixed: vendor fix RHSA-2025:23488
Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4 v4.17.0-1765868606
fixed: vendor fix RHSA-2025:23491
Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10
fixed: vendor fix RHSA-2025:18028
Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-eclipse-jgit 5.13.5.202508271544-2.r_redhat_00001.1.el7eap
fixed: vendor fix RHSA-2026:4915
Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk17 7.4.24-4.GA_redhat_00002.1.el8eap, +1 more
fixed: vendor fix RHSA-2026:4916
Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk17 7.4.24-4.GA_redhat_00002.1.el9eap, +1 more
fixed: vendor fix RHSA-2026:4917
Red Hat JBoss EAP 8.0 for RHEL 8 eap8-yasson 3.0.4-2.redhat_00004.1.el8eap, eap8-jctools 4.0.5-3.redhat_00002.1.el8eap, eap8-parsson 1.1.7-3.redhat_00003.1.el8eap, eap8-stax-ex 2.1.0-3.redhat_00003.1.el8eap, eap8-atinject 2.0.1-5.redhat_00007.1.el8eap, eap8-saaj-impl 3.0.4-2.redhat_00002.1.el8eap, +45 more
fixed: vendor fix RHSA-2025:22773
Red Hat JBoss EAP 8.0 for RHEL 9 eap8-yasson 3.0.4-2.redhat_00004.1.el9eap, eap8-jctools 4.0.5-3.redhat_00002.1.el9eap, eap8-parsson 1.1.7-3.redhat_00003.1.el9eap, eap8-stax-ex 2.1.0-3.redhat_00003.1.el9eap, eap8-atinject 2.0.1-5.redhat_00007.1.el9eap, eap8-saaj-impl 3.0.4-2.redhat_00002.1.el9eap, +45 more
fixed: vendor fix RHSA-2025:22775
Red Hat JBoss EAP 8.1 for RHEL 8 eap8-yasson 3.0.4-2.redhat_00004.1.el8eap, eap8-antlr4 4.13.2-1.redhat_00001.1.el8eap, eap8-jctools 4.0.5-3.redhat_00002.1.el8eap, eap8-parsson 1.1.7-3.redhat_00003.1.el8eap, eap8-stax-ex 2.1.0-3.redhat_00003.1.el8eap, eap8-atinject 2.0.1-5.redhat_00007.1.el8eap, +103 more
fixed: vendor fix RHSA-2025:22187
Red Hat JBoss EAP 8.1 for RHEL 9 eap8-yasson 3.0.4-2.redhat_00004.1.el9eap, eap8-antlr4 4.13.2-1.redhat_00001.1.el9eap, eap8-jctools 4.0.5-3.redhat_00002.1.el9eap, eap8-parsson 1.1.7-3.redhat_00003.1.el9eap, eap8-stax-ex 2.1.0-3.redhat_00003.1.el9eap, eap8-atinject 2.0.1-5.redhat_00007.1.el9eap, +103 more
fixed: vendor fix RHSA-2025:22188
Red Hat JBoss Enterprise Application Platform org.eclipse.jgit 6.10.1.202505221210-r-redhat-00002
fixed: vendor fix RHSA-2025:22190
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-wildfly-modules 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-wildfly-javadocs 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-wildfly-java-jdk8 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-wildfly-java-jdk11 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-eclipse-jgit 5.13.5.202508271544-1.r_redhat_00001.1.el7eap
fixed: vendor fix RHSA-2026:6011
Red Hat JBoss Enterprise Application Platform 7.4.24 org.eclipse.jgit 5.13.5.202508271544-r-redhat-00001
fixed: vendor fix RHSA-2026:4924
Red Hat JBoss Enterprise Application Platform 8.0
fixed: vendor fix RHSA-2025:22777
Red Hat Cryostat 4 org.eclipse.jgit Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4 v4.13.0-1765820400 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4 v4.13.0-1765820400 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4 v4.13.0-1765820400 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4 v4.13.0-1765820400 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4 v4.17.0-1765868580

+2 more productsfewer

Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4 v4.17.0-1765868580 Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4 v4.17.0-1765868580

not affected: vulnerable code not present

14 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 17 mo ago (2025-05-21)

Exploit prediction

0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

gitlab.eclipse.org https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.8	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green
CNA	4.0	6.8	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.eclipse.jgit:org.eclipse.jgit	>=7.2.0.202503040940-r, <7.2.1.202505142326-r >=7.1.0.202411261347-r, <7.1.1.202505221757-r >=7.0.0.202409031743-r, <7.0.1.202505221510-r >=6.1.0.202203080745-r, <6.10.1.202505221210-r >=6.0.0.202110060947-m1, <6.0.0.202111291000-r <5.13.4.202507202350-r	7.2.1.202505142326-r 7.1.1.202505221757-r 7.0.1.202505221510-r 6.10.1.202505221210-r 6.0.0.202111291000-r 5.13.4.202507202350-r

Affected products

Eclipse JGit Eclipse JGit

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference
CWE-827 Improper Control of Document Type Definition

References

gitlab.eclipse.org /security/vulnerability-reports/-/issues/281
issue-tracking, exploit, web
gitlab.eclipse.org /security/cve-assignement/-/issues/64
issue-tracking, web, vendor-advisory
projects.eclipse.org /projects/technology.jgit/releases/7.2.1
release-notes, web
projects.eclipse.org /projects/technology.jgit/releases/7.1.1
release-notes, web
projects.eclipse.org /projects/technology.jgit/releases/7.0.1
release-notes, web
projects.eclipse.org /projects/technology.jgit/releases/6.10.1
release-notes, web
projects.eclipse.org /projects/technology.jgit/releases/5.13.4
release-notes, web
nvd.nist.gov /vuln/detail/CVE-2025-4949
advisory
github.com /eclipse-jgit/jgit
package
projects.eclipse.org /projects/technology.jgit/releases/5.13.5
web

Sources

CVE List CVE-2025-4949
GitHub Advisory GHSA-vrpq-qp53-qv56
NVD CVE-2025-4949

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary