CVE-2018-1000644
Eclipse RDF4j vulnerable to XML External Entity
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
- Record
CVE-2018-1000644- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
- Record
CVE-2018-1000644- Updated
- 2026-11-02
EUVDEUVD-2018-0528 No score
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
- Record
EUVD-2018-0528- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6xq8-pvg4-3mf3
Eclipse RDF4j vulnerable to XML External Entity
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
- Record
GHSA-6xq8-pvg4-3mf3- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
- Record
CVE-2018-1000644- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000644
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
- Record
DEBIAN-CVE-2018-1000644- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-6xq8-pvg4-3mf3
Eclipse RDF4j vulnerable to XML External Entity
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
- Record
GHSA-6xq8-pvg4-3mf3- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.rdf4j:rdf4j-runtimeMaven |
before 2.4.0 | 2.4.0 |
rdf4jDebian:12 |
All versions, plus listed versions 3.7.7+ds-13.7.7+ds-25.3.2-1 |
None known |
rdf4jDebian:13 |
All versions, plus listed versions 3.7.7+ds-13.7.7+ds-25.3.2-1 |
None known |
rdf4jDebian:14 |
before 5.3.2-1, plus listed versions 3.7.7+ds-13.7.7+ds-2 |
5.3.2-1 |
org.eclipse.rdf4j:rdf4j-runtimeMaven |
before 2.4.0, plus listed versions 1.01.0.11.0.21.0.31.0M1 Show 31 moreShow less1.0M21.0M32.02.0.12.0.22.0.32.0M12.0M22.0M32.0M42.12.1.12.1.22.1.32.1.42.1.52.1.62.22.2.12.2.22.2.32.2.42.3-M12.3.02.3.0-M22.3.12.3.22.3.32.4.0-M12.4.0-M22.4.0-M3 |
2.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000644 is a critical vulnerability (CVSS 10.0) in Eclipse Rdf4j, published August 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.75%, the 77th percentile. Fixed in org.eclipse.rdf4j:rdf4j-runtime 2.4.0.