{"id":"CVE-2021-23926","aliases":["CLSA-2026-1770595753","CLSA-2026-1774398093","CLSA-2026-1778028243","DEBIAN-CVE-2021-23926","DLA-2693-1","EUVD-2021-1365","GHSA-mw3r-pfmg-xp92","OESA-2021-1077","SUSE-SU-2022:3875-1","SUSE-SU-2022:3876-1","UBUNTU-CVE-2021-23926","openSUSE-SU-2024:12455-1"],"status":"published","title":"XMLBeans XML Entity Expansion","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0629,"percentile":0.93642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-776"],"published":"2021-01-14T14:45:18Z","modified":"2026-11-02T19:45:26Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlbeans:xmlbeans","fixed_in":["3.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.xmlbeans:xmlbeans","fixed_in":["2.6.0-tuxcare.1","2.3.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xmlbeans","fixed_in":["3.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xmlbeans","fixed_in":["3.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xmlbeans","fixed_in":["3.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"xmlbeans","fixed_in":["2.6.0+dfsg-1+deb9u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"xmlbeans","fixed_in":["2.6.0-2.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xmlbeans","fixed_in":["2.6.0-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlbeans","fixed_in":["2.6.0-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"xmlbeans","fixed_in":["2.6.0-3.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlbeans:xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlbeans:xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.0-tuxcare.1"}]}],"versions":["2.6.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlbeans:xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.0-tuxcare.1"}]}],"versions":["2.3.0"]},{"source":"osv","ecosystem":"Debian:12","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0+dfsg-1+deb9u1"}]}],"versions":["2.6.0+dfsg-1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlbeans:xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}],"versions":["2.2.0","2.3.0","2.4.0","2.5.0","2.6.0"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-2.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-2","2.6.0-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xmlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-2","2.6.0+dfsg-3","3.0.2-1~18.04"]}],"products":[{"vendor":"apache","product":"xmlbeans"},{"vendor":"apache software foundation","product":"apache xmlbeans"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"oncommand_unified_manager_core_package"},{"vendor":"netapp","product":"snap_creator_framework"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"oracle","product":"middleware_common_libraries_and_tools"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"}],"references":[{"url":"https://poi.apache.org/","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","advisory","report"]},{"url":"https://issues.apache.org/jira/browse/XMLBEANS-517","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210513-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23926","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mw3r-pfmg-xp92"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23926","tags":["advisory"]},{"url":"https://poi.apache.org","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210513-0004","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1077","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223875-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180915","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23926","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223876-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23926","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-23926","title":"XMLBeans XML Entity Expansion","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","status":"published","published":"2021-01-14T14:45:18Z","modified":"2025-02-13T16:27:47.031Z","updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2021-1365","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","status":"published","published":"2021-01-14T14:45:18Z","modified":"2025-02-13T16:27:47Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-mw3r-pfmg-xp92","title":"Improper Restriction of Recursive Entity References in Apache XMLBeans","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","status":"published","published":"2021-06-16T17:37:11Z","modified":"2023-01-27T05:02:27Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2021-23926","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","status":"published","published":"2021-01-14T15:15:13.337Z","modified":"2026-06-17T03:39:01.873Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"CVE-2021-23926","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","status":"published","published":"2021-01-14T15:15:13.337Z","modified":"2026-03-15T22:39:27.903481Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-23926","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","status":"published","published":"2021-01-14T15:15:13.337Z","modified":"2026-10-23T18:03:12.050854007Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-mw3r-pfmg-xp92","title":"Improper Restriction of Recursive Entity References in Apache XMLBeans","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","status":"published","published":"2021-06-16T17:37:11Z","modified":"2024-02-19T05:31:48.906957Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"OESA-2021-1077","title":"xmlbeans security update","description":"XMLBeans is a tool that allows you to access the full power of XML in a Java friendly way. It is an XML-Java binding tool. The idea is that you can take advantage the richness and features of XML and XML Schema and have these features mapped as naturally as possible to the equivalent Java language and typing constructs. XMLBeans uses XML Schema to compile Java interfaces and classes that you can then use to access and modify XML instance data. Using XMLBeans is similar to using any other Java interface/class, you will see things like getFoo or setFoo just as you would expect when working with Java. While a major use of XMLBeans is to access your XML instance data with strongly typed Java classes there are also API's that allow you access to the full XML infoset (XMLBeans keeps full XML Infoset fidelity) as well as to allow you to reflect into the XML schema itself through an XML Schema Object model.\r\n\r\nSecurity Fix(es):\r\n\r\nThe XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.(CVE-2021-23926)","status":"published","published":"2021-03-05T11:04:18Z","modified":"2026-08-18T01:15:21.454360746Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-23926","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","status":"published","published":"2021-01-14T15:15:00Z","modified":"2025-10-24T04:50:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"CLSA-2026-1770595753","title":"TuxCare security update for org.apache.xmlbeans:xmlbeans (1 CVE)","description":"TuxCare rebuilt org.apache.xmlbeans:xmlbeans to address 1 CVE. Fixed in 2.6.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:03.837432603Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1774398093","title":"TuxCare security update for 25 packages (3 CVEs)","description":"TuxCare rebuilt 25 packages to address 3 CVEs. Fixed in 2.3.0-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:15Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1778028243","title":"TuxCare security update for org.apache.xmlbeans:xmlbeans (1 CVE)","description":"TuxCare rebuilt org.apache.xmlbeans:xmlbeans to address 1 CVE. Fixed in 2.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-11-02T19:45:26.573849702Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"DLA-2693-1","title":"xmlbeans - security update","status":"published","published":"2021-06-28T00:00:00Z","modified":"2026-03-09T01:22:52.732118Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"openSUSE-SU-2024:12455-1","title":"xmlbeans-2.6.0-12.1 on GA media","description":"These are all security issues fixed in the xmlbeans-2.6.0-12.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:38:08.277412Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:3875-1","title":"Security update for xmlbeans","description":"This update for xmlbeans fixes the following issues:\n\n  - CVE-2021-23926: Fixed XML parsers not protecting from malicious XML input (bsc#1180915).\n","status":"published","published":"2022-11-04T14:12:22Z","modified":"2026-02-04T02:34:32.151484Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3876-1","title":"Security update for xmlbeans","description":"This update for xmlbeans fixes the following issues:\n\n  - CVE-2021-23926: Fixed XML parsers not protecting from malicious XML input (bsc#1180915).\n","status":"published","published":"2022-11-04T14:13:12Z","modified":"2026-02-04T03:04:29.542169Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}