{"id":"CVE-2014-3599","aliases":["CLSA-2026-1784164083","EUVD-2022-5853","GHSA-xrh2-c3rm-35jr"],"status":"published","title":"HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference","description":"HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01203,"percentile":0.68469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2019-11-12T13:27:04Z","modified":"2026-11-02T19:45:43Z","fixes":[{"ecosystem":"Maven","package":"org.hornetq.rest:hornetq-rest","fixed_in":["2.5.0.Beta1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.hornetq.rest:hornetq-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0.Beta1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.hornetq.rest:hornetq-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9.Final"},{"fixed":"2.4.9.Final-tuxcare.1"}]}],"versions":["2.4.9.Final"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.hornetq:hornetq-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9.Final"},{"fixed":"2.4.9.Final-tuxcare.1"}]}],"versions":["2.4.9.Final"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.hornetq.rest:hornetq-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0.Beta1"}]}],"versions":["1.0-beta-1","1.0-beta-2","1.0-beta-3","2.2.2.1","2.2.2.2","2.2.2.Final","2.3.0.Alpha","2.3.0.BETA1","2.3.0.BETA2","2.3.0.BETA3","2.3.0.CR1","2.3.0.CR2","2.3.0.Final","2.3.1.Final","2.3.10.Final","2.3.11.Final","2.3.12.Final","2.3.13.Final","2.3.15.Final","2.3.17.Final","2.3.18.Final","2.3.19.Final","2.3.2.Final","2.3.22.Final","2.3.23.Final","2.3.24.Final","2.3.25.Final","2.3.3.Final","2.3.4.Final","2.3.5.Final","2.3.6.Final","2.3.7.Final","2.3.8.Final","2.3.9.Final","2.4.0.Alpha1","2.4.0.Beta1","2.4.0.Beta2","2.4.0.Beta3","2.4.0.Final","2.4.1.Final","2.4.10.Final","2.4.11.Final","2.4.2.Final","2.4.3.Final","2.4.4.Final","2.4.5.Final","2.4.6.Final","2.4.7.Final","2.4.8.Final","2.4.9.Final"]}],"products":[{"vendor":"hornetq rest","product":"hornetq rest"},{"vendor":"redhat","product":"hornetq"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3599","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/cve-2014-3599","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3599","tags":["advisory"]},{"url":"https://github.com/hornetq/hornetq/commit/b3a63576371828d5f8e64ba7ccbcecb1da8111d2","tags":["web"]},{"url":"https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3599.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xrh2-c3rm-35jr"},{"url":"https://github.com/hornetq/hornetq","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2014-3599","description":"HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy","status":"published","published":"2019-11-12T13:27:04Z","modified":"2024-08-06T10:50:17.655Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2022-5853","description":"HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy","status":"published","published":"2019-11-12T13:27:04Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-xrh2-c3rm-35jr","title":"HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference","description":"HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy.","status":"published","published":"2022-05-24T22:01:08Z","modified":"2023-02-02T05:03:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:40.500292Z"}],"nvd":[{"id":"CVE-2014-3599","description":"HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy","status":"published","published":"2019-11-12T14:15:11.093Z","modified":"2026-06-17T00:08:35.807Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"GHSA-xrh2-c3rm-35jr","title":"HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference","description":"HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy.","status":"published","published":"2022-05-24T22:01:08Z","modified":"2026-09-10T03:49:41.88765658Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"CLSA-2026-1784164083","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 2.4.9.Final-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-11-02T19:45:43.164955315Z","updated_at":"2026-11-02T20:30:13.950198Z"}]}}