CVE-2026-119724
Description
A flaw was found in Apache jclouds. The XML parser does not properly restrict recursive entity references within Document Type Definitions (DTDs). By submitting a specially crafted XML document containing recursive entity definitions, a remote attacker could consume excessive memory and CPU resources, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can exhaust system CPU and memory resources with minimal complexity, leading to an application-wide denial of service. In Red Hat environments, Apache jclouds is typically embedded within management services to communicate with cloud infrastructure providers. Exposure is limited to scenarios where the application ingests and parses XML payloads from untrusted network sources or compromised cloud API endpoints. Deployments communicating exclusively with trusted endpoints over authenticated channels face lower risk.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other)
If the DTD contains a large number of nested or recursive entities, this allows the attacker to expand data exponentially when the DTD is parsed, quickly consuming all system resources.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
