CVE-2026-61586
Description
A flaw was found in Copernik XML Factory. When an application enables XML Inclusions (XInclude) while using the stock Java Development Kit (JDK) parser, the library fails to restrict external resource resolution. A remote attacker can exploit this flaw by submitting crafted XML input containing malicious include references. Successful exploitation primarily results in information disclosure through the unauthorized reading of local files, and may also permit the attacker to reach internal network endpoints via server-side request forgery (SSRF).
Statement
This flaw is rated with an Important severity impact because unauthenticated remote attackers can potentially read arbitrary local files or trigger server-side request forgery (SSRF) against internal services. To be vulnerable, an application must explicitly enable XML inclusion processing while handling untrusted input on a runtime environment using the standard JDK parser without Apache Xerces. Under default conditions where XInclude remains unconfigured or where Xerces-based parsing implementations are deployed, applications are not exposed to this resource resolution weakness.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable XInclude awareness or enforce a deny-all EntityResolver on stock JDK XML parsers configured via Copernik XML Factory: upgrade to Copernik XML Factory 0.1.2, which enforce a permanent deny-all EntityResolver floor across DocumentBuilder and XMLReader instances to fail external XInclude resolution closed, closing all 2 injection vectors (crafted xi:include elements referencing local files, crafted xi:include elements referencing internal HTTP endpoints). Until patched, this is only a concern on Applications using Copernik XML Factory on stock JDK parsers without Apache Xerces and with XInclude enabled on untrusted input — Deployments with Apache Xerces on the classpath, Android runtimes, or parsers without XInclude enabled are unaffected — so Disable XInclude awareness when parsing untrusted XML, add Apache Xerces (xercesImpl) to the application classpath, or configure a custom restrictive EntityResolver. As a compensating measure, Restrict outbound egress traffic to internal endpoints and cloud metadata services to contain SSRF risks and Deploy eBPF runtime security to detect unauthorized local file reads and anomalous outbound network requests initiated by the Java process. These controls limit blast radius and contain exploitation, but they do not fix the underlying unrestricted XInclude resource resolution defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1317 XML External Entity Prevention (Secure XML Parser Configuration) (high)
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system. By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g., in an error message), thereby exposing the file contents.
Integrity
Technical Impact: Bypass Protection Mechanism
An attacker may supply a crafted DTD using URIs with schemes such as http://, forcing the application to make outgoing HTTP requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions; hide the source of attacks such as port scanning; or otherwise leverage the server's trust relationship with other entities.
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
The product could consume excessive CPU cycles or memory using a URI that points to a large file, or a device that always returns data such as /dev/random. Alternately, the URI could reference a file that contains many nested or recursive entity references to further slow down parsing.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
