{"id":"GHSA-826p-4gcg-35vw","aliases":[],"status":"published","title":"GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling","description":"### Summary\n\nGeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.\n\n### Impact\n\nThis impacts whoever exposes XML processing with ``gt-xsd-core`` involved in parsing, when the documents carry a reference to an external XML schema. The ``gt-xsd-core`` Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).\n\nThis also impacts users of ``gt-wfs-ng`` DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended.\n\n### Resolution\n\nGeoTools API change allows EntityResolver to be supplied to the following methods:\n\n```java\nSchemas.parse( location, locators, resolvers, uriHandlers, entityResolver);\nSchemas.findSchemas(Configuration configuration, EntityResolver entityResolver);\n```\n\nWith this API change the `gt-wfs-ng` WFS DataStore ENTITY_RESOLVER parameter is now used.\n\n### Reference\n\n* [GHSA-jj54-8f66-c5pc](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc): Describes the impact of the ``gt-xsd-core`` vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files.\n\n* [GHSA-2p76-gc46-5fvc](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc): Describes the impact of the ``gt-wfs-ng`` and ``gt-xsd-core`` vulnerability on the GeoNetwork WFS Index functionality.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2025-06-09T23:14:48Z","modified":"2026-02-04T04:28:18Z","fixes":[{"ecosystem":"Maven","package":"org.geotools:gt-xsd-core","fixed_in":["33.1","32.3","31.7","28.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","fixed_in":["33.1","32.3","31.7","28.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.geotools:gt-xsd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"33.0"},{"last_affected":"33.0"},{"fixed":"33.1"}]}],"versions":["33.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.geotools:gt-xsd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"32.0"},{"fixed":"32.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.geotools:gt-xsd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"last_affected":"31.6"},{"fixed":"31.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"33.0"},{"fixed":"33.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"32.0"},{"fixed":"32.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"last_affected":"31.6"},{"fixed":"31.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.geotools:gt-xsd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geotools:gt-xsd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"33.0"},{"fixed":"33.1"}]}],"versions":["33.0"]},{"source":"osv","ecosystem":"Maven","package":"org.geotools:gt-xsd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"32.0"},{"fixed":"32.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geotools:gt-xsd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"fixed":"31.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"33.0"},{"fixed":"33.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"32.0"},{"fixed":"32.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"fixed":"31.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geotools:gt-xsd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geotools:gt-wfs-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6.1"}]}]}],"references":[{"url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc","tags":["web"]},{"url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc","tags":["web"]},{"url":"https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw","tags":["web"]},{"url":"https://github.com/advisories/GHSA-826p-4gcg-35vw"},{"url":"https://github.com/geotools/geotools","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-826p-4gcg-35vw","title":"GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling","description":"### Summary\n\nGeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.\n\n### Impact\n\nThis impacts whoever exposes XML processing with ``gt-xsd-core`` involved in parsing, when the documents carry a reference to an external XML schema. The ``gt-xsd-core`` Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).\n\nThis also impacts users of ``gt-wfs-ng`` DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended.\n\n### Resolution\n\nGeoTools API change allows EntityResolver to be supplied to the following methods:\n\n```java\nSchemas.parse( location, locators, resolvers, uriHandlers, entityResolver);\nSchemas.findSchemas(Configuration configuration, EntityResolver entityResolver);\n```\n\nWith this API change the `gt-wfs-ng` WFS DataStore ENTITY_RESOLVER parameter is now used.\n\n### Reference\n\n* [GHSA-jj54-8f66-c5pc](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc): Describes the impact of the ``gt-xsd-core`` vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files.\n\n* [GHSA-2p76-gc46-5fvc](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc): Describes the impact of the ``gt-wfs-ng`` and ``gt-xsd-core`` vulnerability on the GeoNetwork WFS Index functionality.","status":"published","published":"2025-06-09T23:14:48Z","modified":"2025-06-09T23:14:50Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"osv":[{"id":"GHSA-826p-4gcg-35vw","title":"GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling","description":"### Summary\n\nGeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.\n\n### Impact\n\nThis impacts whoever exposes XML processing with ``gt-xsd-core`` involved in parsing, when the documents carry a reference to an external XML schema. The ``gt-xsd-core`` Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).\n\nThis also impacts users of ``gt-wfs-ng`` DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended.\n\n### Resolution\n\nGeoTools API change allows EntityResolver to be supplied to the following methods:\n\n```java\nSchemas.parse( location, locators, resolvers, uriHandlers, entityResolver);\nSchemas.findSchemas(Configuration configuration, EntityResolver entityResolver);\n```\n\nWith this API change the `gt-wfs-ng` WFS DataStore ENTITY_RESOLVER parameter is now used.\n\n### Reference\n\n* [GHSA-jj54-8f66-c5pc](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc): Describes the impact of the ``gt-xsd-core`` vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files.\n\n* [GHSA-2p76-gc46-5fvc](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc): Describes the impact of the ``gt-wfs-ng`` and ``gt-xsd-core`` vulnerability on the GeoNetwork WFS Index functionality.","status":"published","published":"2025-06-09T23:14:48Z","modified":"2026-02-04T04:28:18.471515Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:41.732368Z"}]}}