CVE-2026-15803 is an XML External Entity (XXE) vulnerability in Eclipse RDF4J caused by several XML parser entry points not fully restricting XXE processing. This permits DOCTYPE declarations, external entity references, and external DTD loading when parsing untrusted XML-based RDF data or query results. The root cause is an incomplete fix for CVE-2018-1000644, where not all parser entry points were covered. The vulnerability is resolved in RDF4J version 5.3.2, which rejects or disables these XML features by default to prevent XXE attacks.

An attacker can exploit this vulnerability to perform XML External Entity attacks, potentially leading to exposure of sensitive information or denial of service. The CVSS 4.0 base score is 8.7 (high severity), indicating a network attack vector with no required privileges or user interaction and high impact on confidentiality. There are no known exploits in the wild at this time.

The vulnerability is fixed in Eclipse RDF4J version 5.3.2, which disables DOCTYPE declarations, external entities, and external DTD loading by default. Users should upgrade to version 5.3.2 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be in 5.3.2. Until upgraded, avoid parsing untrusted XML data or apply custom XML parser configurations to disable external entity processing.