Log in Start free

Vulnerability · Published May 21, 2025 · Assigned by eclipse

CVE-2025-4949XXE vulnerability in Eclipse JGit

Medium 6.8

In plain English

A medium-severity XML external entity in Eclipse JGit from Eclipse JGit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.8Medium
Exploit odds (30 days)0.8%top 41.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jgitno fix listedDEBIAN-CVE-2025-4949
Debian:13jgitno fix listedDEBIAN-CVE-2025-4949
Debian:14jgitno fix listedDEBIAN-CVE-2025-4949
Mavenorg.eclipse.jgit:org.eclipse.jgit6.10.1.202505221210-rGHSA-vrpq-qp53-qv56
Mavenorg.eclipse.jgit:org.eclipse.jgit6.0.0.202111291000-rGHSA-vrpq-qp53-qv56
Mavenorg.eclipse.jgit:org.eclipse.jgit5.13.4.202507202350-rGHSA-vrpq-qp53-qv56
Mavenorg.eclipse.jgit:org.eclipse.jgit7.2.1.202505142326-rGHSA-vrpq-qp53-qv56
Mavenorg.eclipse.jgit:org.eclipse.jgit7.1.1.202505221757-rGHSA-vrpq-qp53-qv56
Mavenorg.eclipse.jgit:org.eclipse.jgit7.0.1.202505221510-rGHSA-vrpq-qp53-qv56
Ubuntu:22.04:LTSjgitno fix listedUBUNTU-CVE-2025-4949
Ubuntu:24.04:LTSjgitno fix listedUBUNTU-CVE-2025-4949
Ubuntu:25.10jgitno fix listedUBUNTU-CVE-2025-4949
Ubuntu:26.04:LTSjgitno fix listedUBUNTU-CVE-2025-4949
Ubuntu:26.10jgitno fix listedUBUNTU-CVE-2025-4949

Affected products (as reported)

VendorProductVersions
Eclipse JGit Eclipse JGit 7.2.0 – before 7.2.1.202505142326-r7.1.0 – before 7.1.1.202505221757-r7.0.0 – before 7.0.1.202505221510-r0 – before 5.13.4.202507202350-r6.0.0 – before 6.10.1.202505221210-r
Eclipse JGit Eclipse JGit 7.2.0 – before 7.2.1.202505142326-r7.1.0 – before 7.1.1.202505221757-r7.0.0 – before 7.0.1.202505221510-r0 – before 5.13.4.202507202350-r6.0.0 – before 6.10.1.202505221210-r

Weakness: CWE-611, CWE-827 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green

References