CVE-2025-4949: XXE vulnerability in Eclipse JGit
Analyzed
AliasesSUSE-SU-2025:02762-1RHSA-2025:22187RHSA-2025:22188RHSA-2025:22773RHSA-2025:22775UBUNTU-CVE-2025-4949DEBIAN-CVE-2025-4949CGA-23mw-6gch-r9mpCGA-2vqq-vqxc-q4w3CGA-2vrw-37j4-cm4hCGA-5gv4-p7fm-8cg4CGA-5vmq-c7hh-348pCGA-6c94-4rv8-r27vCGA-6p58-9h88-p2mxCGA-729w-mpw8-ff78CGA-865w-9gfp-h244CGA-8pjw-xrm4-wwvpCGA-8qx5-4pwm-wxwhCGA-c873-52g6-j27rCGA-cp2j-rrx6-vr34CGA-f87x-6x4m-pqj7CGA-fcq5-rc36-jqcvCGA-fq2w-g74q-fg8cCGA-gjw3-gxfm-jv27CGA-gvp5-mv2h-4chxCGA-h9wx-4m48-3pqxCGA-hq6w-26gr-j5pqCGA-hwj4-jcg3-573vCGA-j8m8-3v5w-mf8vCGA-jf8f-6q3v-m9pvCGA-jqhw-7v8q-g3c5CGA-jwmh-x2fc-q84xCGA-m93f-7344-rhvpCGA-mfw8-hv6w-fr7gCGA-p4fp-jmfw-j726CGA-pr8m-593x-9rgqCGA-q8hv-2qfr-c3c6CGA-qhw4-86rh-gwhrCGA-qp6q-qmmg-vf63CGA-r4mg-j52r-4j4jCGA-v3jv-f644-g985CGA-vm77-5535-6hc4CGA-vrvw-844v-qhjvCGA-vxxq-fwr3-m8r8CGA-wp9m-r67r-439fCGA-wxwg-gvm4-554jCGA-xf55-2448-6qr8CGA-24jj-65cm-2242CGA-27wj-w5rw-jfxqCGA-2f9f-4548-8vm3CGA-2fqw-pj7f-xv4mCGA-2fxf-6mm2-v5mjCGA-2g3f-5g3f-jx2fCGA-2hrj-gq2f-42fmCGA-2j5v-rj92-4ggcCGA-2v9f-f7hh-2247CGA-2w54-wrf2-r7qhCGA-2wf4-mfcr-5wf2CGA-2wgv-m45h-472vCGA-34r9-mf7v-m6mrCGA-363j-w447-cg7xCGA-376r-w36c-4mpjCGA-39mq-fpxg-vc46CGA-3f7p-2h7r-fm67CGA-3p7w-mhf7-mjh4CGA-3w4x-7r5h-wf3pCGA-43m9-86m8-w93wCGA-45q8-85hx-rwhqCGA-4873-8qpg-f9x7CGA-48r5-qrfp-p286CGA-4972-7933-hq2wCGA-4f5r-3gx6-39j9CGA-4g7c-hw76-fg48CGA-4h2p-w7c8-cq6jCGA-4p98-485m-vfvqCGA-4p9g-g5qg-vh9vCGA-4qjj-9hp4-6gp5CGA-4w3p-c63p-rp6rCGA-4w4h-ccwg-v795CGA-4wc3-ggf5-3959CGA-568r-73f7-7fr9CGA-56c4-qrcr-2vhrCGA-5873-q3xj-grhvCGA-5grw-8m97-xqwhCGA-5pc2-fx45-8gqcCGA-5pfx-mppw-9wvpCGA-5xqr-4x84-x8hgCGA-66p2-x5jr-7wqhCGA-68gj-33gv-jc7gCGA-68wr-pcfj-2r9mCGA-69cf-3gcw-667jCGA-6f2x-pf8v-8965CGA-6f76-7x78-hp5hCGA-6g69-2hjm-vq9cCGA-6h8x-xmv9-qmfcCGA-6jfm-pfw2-v4cqCGA-6q36-h72h-q8v4CGA-6q73-rgfc-jpq7CGA-6qqx-r4r4-4548CGA-6rmf-fm4q-454xCGA-72j4-wrv4-w43jCGA-769v-f2p2-jc53CGA-76fg-c9r9-gxj6CGA-76j5-84xc-266xCGA-76x3-2g5c-f9xvCGA-7ggr-37qg-rcf8CGA-7m64-6w58-6f57CGA-7qwh-93q9-3v2pCGA-853p-jx7x-vj2qCGA-865r-63f3-4hw3CGA-86ch-pw4r-gqv8CGA-89cj-7wcx-53mfCGA-8fx6-m3j6-7x62CGA-8pjv-rrv9-xpw4CGA-8v6v-jrf8-g9rvCGA-8vq5-2vf4-g73jCGA-8wpg-c9xh-rcrcCGA-9626-xx5r-h4cpCGA-986p-qg6g-2cghCGA-9957-gr2m-3mw8CGA-9c39-m83q-rq5vCGA-9cjm-r9f7-wpp4CGA-9fhv-h2vp-8w3fCGA-9h6g-5mx5-7639CGA-9m76-8xxh-c5g2CGA-9p62-hjmq-73xjCGA-9qfr-9x25-g8mpCGA-9w6g-4mxq-m9hgCGA-c22h-c34w-v4h5CGA-c2c3-hg69-4cg5CGA-c393-wcw5-x8rhCGA-c6qq-55jx-r8v2CGA-ch3w-rc7c-57phCGA-ch9p-rm9g-p62hCGA-cpwf-qw5f-3372CGA-cqp7-577p-v5x7CGA-cv48-7579-cx99CGA-cw22-jhq4-58xhCGA-cxj4-m9g3-c832CGA-f2v5-h6rr-qhmpCGA-f59x-36wx-r2wcCGA-f5fv-frgq-38vwCGA-f7wj-3jv6-7vvwCGA-f82v-4p2v-fmrcCGA-ff5w-g4xv-4967CGA-fgfg-p6c4-p983CGA-fggv-472j-p958CGA-fq3v-4645-ccgrCGA-fq3x-936v-35vhCGA-fqrm-3qcv-768jCGA-fw86-2cmv-6gj6CGA-g482-c26x-4cf3CGA-g542-qrv9-qv8gCGA-g7vr-2gx5-97pxCGA-g893-vxm2-q2gpCGA-g8hj-3m57-phcgCGA-g933-776v-49m6CGA-g9vp-9r7q-fhrpCGA-gf6v-qmhv-hpr5CGA-gh4w-4vgh-878pCGA-ghwv-wc7j-8pv7CGA-gm52-8rxm-v2w8CGA-gm7g-vfcm-vf7hCGA-gq4h-p6jv-hhq5CGA-grm2-4vf5-f785CGA-grvp-rr2p-c8f2CGA-gv7g-x7xh-7qvrCGA-gvp5-jqxg-6pxhCGA-gwvp-frmj-jgj3CGA-h3c9-w95x-872wCGA-h43p-7fxj-3r68CGA-h5wj-xxgg-wwfvCGA-h6fg-h2p5-vc8vCGA-h739-2vrg-554vCGA-h7p9-jr64-pfmcCGA-h849-fpxg-6pm7CGA-h8xh-v452-g6cvCGA-h96f-4pr8-9c77CGA-h987-cm9g-3r9cCGA-hf68-c9m7-9q6pCGA-hh7j-67w7-hpmrCGA-hm55-f2gg-hr6vCGA-hv5f-fw57-v42rCGA-hxg3-97f2-jvvpCGA-j3rx-58xm-7wvgCGA-j5w2-26v5-7h9qCGA-j9hx-p735-h5fhCGA-j9w2-qq25-f5vcCGA-jfmf-h58q-qx92CGA-jhpq-322j-44gfCGA-jpxf-wrjm-9mxqCGA-jrmm-8v35-47xxCGA-m2gr-2xvf-83w9CGA-m2q4-4x57-ffv7CGA-m52p-2g9h-mfp7CGA-m623-fx55-hcxhCGA-m7xr-wm8c-m34vCGA-mh23-m5gr-7v69CGA-mjc7-72mq-8f4mCGA-mqhg-9cjh-3f23CGA-mv2f-9v86-4cqmCGA-mv9f-qpm2-5c95CGA-mw47-x4vp-4cjxCGA-mx65-j84f-7p6rCGA-mxm4-79pr-rfx4CGA-p2vr-7fx9-7c42CGA-p5hv-32mc-5mh4CGA-p5w6-x358-wg9jCGA-p6h6-9xvx-pmq7CGA-pcc5-3p6j-wq37CGA-pcfr-xmh4-g4qcCGA-pf83-8pxg-vjxfCGA-pgv3-pw9v-v668CGA-pq7j-4f6x-jfrwCGA-pvxq-95jf-9prpGHSA-vrpq-qp53-qv56CGA-q3cj-29g7-74vqCGA-q489-f7w6-p9w4CGA-q6h4-89h8-vc4xCGA-q9rp-pf4p-chfvCGA-qpp7-2f6c-577xCGA-qqj7-fphj-m246CGA-qr47-wqwj-2wj5CGA-qwpp-p5rr-q6rwCGA-qx29-rw6w-6x92CGA-r33c-j9j9-8589CGA-r365-pv2c-252mCGA-r747-rj3m-63m2CGA-r7wh-c5x2-35g2CGA-r84q-v9v8-ch89CGA-r9h3-xhw4-7887CGA-rchh-w4mp-w8chCGA-rf3j-p6mv-36j8CGA-rg58-9g77-vgr2CGA-rjfq-mqvv-rcrhCGA-rv9v-wrjv-5h5hCGA-rwp9-c5xm-m342CGA-rx9w-xvwf-gwcwCGA-v34f-fj59-3h2jCGA-v5g2-8h55-3f3hCGA-vq63-498f-m5vjCGA-w3px-jr4x-qqh4CGA-w59h-crwj-pwm3CGA-w88r-q7q2-q35xCGA-wgp6-f6c3-c24hCGA-wj2c-p3w5-fwq6CGA-wj8m-qv7p-fm39CGA-wmh9-whxw-7q5mCGA-wv2p-9hpj-fg6pCGA-x226-8qc9-w44rCGA-x8gw-jppx-vj38CGA-x8v2-8r94-9365CGA-xcvj-8rr3-x357CGA-xcw3-84hw-38g7CGA-xj7g-p79m-2h64CGA-xq44-m69r-w25pCGA-xw7g-g7fm-h8w5
Published 21-05-2025Last modified 14-10-2025
Vulnerability summary
CVE-2025-4949 is a medium (CVSS 6.8) vulnerability in eclipse jgit. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 58% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Routine
Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.8/10
010
Medium · v4.0 (CVE.org)EPSS score
0.84%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 21-05-2025PublishedVulnerability first disclosed.
- 14-10-2025Last modifiedVulnerability information updated.
Description
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
CVSS metrics
10 scores · 8 sources · 2 versionsMedium 6.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:GreenSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green
- OSV · WolfiEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green
- OSV · MavenEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- NVDNIST6.8MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green
Medium 4.8Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:HSources4 sources · 4.8–5.3
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HDiffers
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.84%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.81% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (gitlab.eclipse.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
- CWE-827Improper Control of Document Type DefinitionThe product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
Affected systems
Version check
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard123 products
- apache-nifi-registry< 2.4.0-r1
- apache-nifi-registry-toolkit< 2.4.0-r1
- apicurio-registry< 3.0.7-r1
- apicurio-registry-nginx-config< 3.0.7-r1
- apicurio-registry-ui< 3.0.7-r1
Redhat51 products
- eap8-activemq-artemis< 0:2.40.0-3.redhat_00008.1.el8eap | < 0:2.40.0-3.redhat_00008.1.el9eap
- eap8-activemq-artemis-cli< 0:2.40.0-3.redhat_00008.1.el8eap | < 0:2.40.0-3.redhat_00008.1.el9eap
- eap8-activemq-artemis-commons< 0:2.40.0-3.redhat_00008.1.el8eap | < 0:2.40.0-3.redhat_00008.1.el9eap
- eap8-activemq-artemis-core-client< 0:2.40.0-3.redhat_00008.1.el8eap | < 0:2.40.0-3.redhat_00008.1.el9eap
- eap8-activemq-artemis-dto< 0:2.40.0-3.redhat_00008.1.el8eap | < 0:2.40.0-3.redhat_00008.1.el9eap
Wolfi20 products
- apache-nifi-registry< 2.4.0-r1
- apache-nifi-registry-toolkit< 2.4.0-r1
- apicurio-registry< 3.0.7-r1
- apicurio-registry-nginx-config< 3.0.7-r1
- apicurio-registry-ui< 3.0.7-r1
Debian1 product
- jgitAll versions (No fix recorded)
Eclipse1 product
- jgit< 5.13.4 | ≥ 6.0.0, < 6.10.1.202505221210 | ≥ 7.0.0, < 7.0.1.202505221510 | ≥ 7.1.0, < 7.1.1.202505221757 | ≥ 7.2.0, < 7.2.1.202505142326
Eclipse jgit1 product
- eclipse jgit≥ 7.2.0, < 7.2.1.202505142326-r | ≥ 7.1.0, < 7.1.1.202505221757-r | ≥ 7.0.0, < 7.0.1.202505221510-r | < 5.13.4.202507202350-r | ≥ 6.0.0, < 6.10.1.202505221210-r
Opensuse1 product
- eclipse-jgit&distro=openSUSE Leap 15.6< 5.11.0-150200.3.23.1
Org.eclipse.jgit1 product
- org.eclipse.jgit≥ 7.2.0.202503040940-r, < 7.2.1.202505142326-r | ≥ 7.1.0.202411261347-r, < 7.1.1.202505221757-r | ≥ 7.0.0.202409031743-r, < 7.0.1.202505221510-r | ≥ 6.1.0.202203080745-r, < 6.10.1.202505221210-r | ≥ 6.0.0.202110060947-m1, < 6.0.0.202111291000-r | < 5.13.4.202507202350-r
Ubuntu1 product
- jgitAll versions (No fix recorded)
9 vendors · 200 products · Showing 200 of 277
References
75 links- gitlab.eclipse.org/security/cve-assignement/-/issues/64Issue TrackingARTICLEREPORTWEBVendor Advisory
Show all 75 references
- github.com/eclipse-jgit/jgitPACKAGE