What’s Vulnerable › Vulnerabilities
CVE-2022-28890: Processing external DTDs
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-05-05 · updated 2026-06-17
- Weakness: CWE-611
Description
A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.
Affected products
References
- https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878
- https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878
Get alerted when CVE-2022-28890 or the next vulnerability affects your stack