Every CVE Search/ Get API key

CVE-2021-23926

XMLBeans XML Entity Expansion

9.1 CriticalFix available

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

6.29%Up 3.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.1

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Record
CVE-2021-23926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness
CWE-776
Updated
2026-11-02
CVE List No score

XMLBeans XML Entity Expansion

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Record
CVE-2021-23926
Updated
2026-11-02
EUVDEUVD-2021-1365 0.0

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Record
EUVD-2021-1365
CVSS
0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-mw3r-pfmg-xp92 9.1

Improper Restriction of Recursive Entity References in Apache XMLBeans

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Record
GHSA-mw3r-pfmg-xp92
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-776
Updated
2026-11-02
OSV 9.1

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Record
CVE-2021-23926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-23926 9.1

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Record
DEBIAN-CVE-2021-23926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVGHSA-mw3r-pfmg-xp92 9.1

Improper Restriction of Recursive Entity References in Apache XMLBeans

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Record
GHSA-mw3r-pfmg-xp92
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-776
Updated
2026-11-02
OSVOESA-2021-1077 9.1

xmlbeans security update

XMLBeans is a tool that allows you to access the full power of XML in a Java friendly way. It is an XML-Java binding tool. The idea is that you can take advantage the richness and features of XML and XML Schema and have these features mapped as naturally as possible to the equivalent Java language and typing constructs. XMLBeans uses XML Schema to compile Java interfaces and classes that you can then use to access and modify XML instance data. Using XMLBeans is similar to using any other Java interface/class, you will see things like getFoo or setFoo just as you would expect when working with Java. While a major use of XMLBeans is to access your XML instance data with strongly typed Java classes there are also API's that allow you access to the full XML infoset (XMLBeans keeps full XML Infoset fidelity) as well as to allow you to reflect into the XML schema itself through an XML Schema Object model.

Security Fix(es):

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.(CVE-2021-23926)

Record
OESA-2021-1077
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-23926 9.1

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Record
UBUNTU-CVE-2021-23926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1770595753 No score

TuxCare security update for org.apache.xmlbeans:xmlbeans (1 CVE)

TuxCare rebuilt org.apache.xmlbeans:xmlbeans to address 1 CVE. Fixed in 2.6.0-tuxcare.1.

Record
CLSA-2026-1770595753
Updated
2026-11-02
OSVCLSA-2026-1774398093 No score

TuxCare security update for 25 packages (3 CVEs)

TuxCare rebuilt 25 packages to address 3 CVEs. Fixed in 2.3.0-tuxcare.1.

Record
CLSA-2026-1774398093
Updated
2026-11-02
OSVCLSA-2026-1778028243 No score

TuxCare security update for org.apache.xmlbeans:xmlbeans (1 CVE)

TuxCare rebuilt org.apache.xmlbeans:xmlbeans to address 1 CVE. Fixed in 2.3.0-tuxcare.1.

Record
CLSA-2026-1778028243
Updated
2026-11-02
OSVopenSUSE-SU-2024:12455-1 No score

xmlbeans-2.6.0-12.1 on GA media

These are all security issues fixed in the xmlbeans-2.6.0-12.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12455-1
Updated
2026-11-02
OSVSUSE-SU-2022:3875-1 No score

Security update for xmlbeans

This update for xmlbeans fixes the following issues:

  • CVE-2021-23926: Fixed XML parsers not protecting from malicious XML input (bsc#1180915).
Record
SUSE-SU-2022:3875-1
Updated
2026-11-02
OSVSUSE-SU-2022:3876-1 No score

Security update for xmlbeans

This update for xmlbeans fixes the following issues:

  • CVE-2021-23926: Fixed XML parsers not protecting from malicious XML input (bsc#1180915).
Record
SUSE-SU-2022:3876-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.xmlbeans:xmlbeans
Maven
 before 3.0.0
3.0.0
org.apache.xmlbeans:xmlbeans
TuxCare:Maven
 2.6.0 up to 2.6.0-tuxcare.1
2.6.0-tuxcare.1
org.apache.xmlbeans:xmlbeans
TuxCare:Maven
 2.3.0 up to 2.3.0-tuxcare.1
2.3.0-tuxcare.1
xmlbeans
Debian:12
 before 3.0.2-1
3.0.2-1
xmlbeans
Debian:13
 before 3.0.2-1
3.0.2-1
xmlbeans
Debian:14
 before 3.0.2-1
3.0.2-1
xmlbeans
Debian:9
 before 2.6.0+dfsg-1+deb9u1, plus listed versions
2.6.0+dfsg-1
2.6.0+dfsg-1+deb9u1
org.apache.xmlbeans:xmlbeans
Maven
 before 3.0.0, plus listed versions
2.2.02.3.02.4.02.5.02.6.0
3.0.0
xmlbeans
openEuler:20.03-LTS-SP1
 before 2.6.0-2.oe1
2.6.0-2.oe1
xmlbeans
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
xmlbeans
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Manager Proxy 4.1
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Manager Retail Branch Server 4.1
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Manager Server 4.1
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Enterprise Storage 7
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
openSUSE:Leap 15.3
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
openSUSE:Leap 15.4
 before 2.6.0-150000.5.3.1
2.6.0-150000.5.3.1
xmlbeans
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.6.0-3.3.1
2.6.0-3.3.1
xmlbeans
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 2.6.0-3.3.1
2.6.0-3.3.1
xmlbeans
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0-22.6.0-3
 None known
xmlbeans
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-22.6.0+dfsg-33.0.2-1~18.04
 None known

History

History
RecordedChangedSources
facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-23926 is a critical vulnerability (CVSS 9.1) in Apache Xmlbeans, published January 14, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.29%, the 93rd percentile. Fixed in org.apache.xmlbeans:xmlbeans 3.0.0.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open