CVE-2026-108086: CWE-776 Improper restriction of recursive entity references in DTDs ('XML entity expansion') in Apache Software Foundation Apache Cocoon
Description
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected software
Apache Software Foundation
Apache Cocoon
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability, identified as CWE-776, concerns improper restriction of recursive XML entity references in the form processor (fp:) of Apache Cocoon. Exploitation of this XML entity expansion (XEE) flaw can result in SSRF attacks, including unauthorized exposure of server files to external entities. Since Apache Cocoon is no longer maintained, no official patch or fix will be provided.
Potential Impact
The vulnerability allows attackers to perform SSRF attacks and potentially access sensitive files on the server by abusing XML entity expansion in the form processor. This could lead to information disclosure and unauthorized interactions with internal or external systems. However, no known exploits are reported in the wild.
Mitigation Recommendations
No official fix or patch is available as Apache Cocoon is retired and unsupported. Users should migrate to alternative supported solutions or restrict access to Apache Cocoon instances strictly to trusted users to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-10-09T12:19:19.802Z
- State
- PUBLISHED
Threat ID: 6ad743942cdf04f6561fc718
Added to database: 10/20/2026, 10:33:56 UTC
Last enriched: 10/20/2026, 10:48:35 UTC
Last updated: 10/20/2026, 22:33:06 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.