CVE-2026-92877: CWE-611 in Eclipse Foundation jaxb-ri (core)

The JAXB factory methods in jaxb-ri (core) historically relied only on the FEATURE_SECURE_PROCESSING feature to prevent XML External Entity (XXE) resolution. However, on JAXP implementations where this feature does not fully block external entity resolution, an attacker able to supply untrusted XML for unmarshalling can exploit this to read local files through out-of-band XXE attacks. This vulnerability is tracked as CWE-611 and affects specific versions of jaxb-ri (core).

An attacker who can cause untrusted XML to be unmarshalled by vulnerable versions of jaxb-ri may read local files on the system via out-of-band XXE. This can lead to information disclosure of sensitive local data. The CVSS 4.0 score is 8.3 (high), reflecting network attack vector, high impact on confidentiality, and low attack complexity without user interaction or privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor for vendor updates or advisories from the Eclipse Foundation regarding this vulnerability. Until a fix is available, avoid unmarshalling untrusted XML with affected versions or apply additional XML processing restrictions if possible.