{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapacheabdera/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:abdera:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-113582"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Abdera (all versions)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","xxe","web-application"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Abdera is susceptible to XML external entity (XXE) injection due to improper restriction of XML entity references. This vulnerability allows an unauthenticated attacker to manipulate XML input to access local files or trigger unauthorized server-side requests. Because the Apache Abdera project is retired and unsupported, no security patches will be released.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the disclosure of sensitive server-side data or the execution of server-side request forgery (SSRF) attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate all applications currently utilizing Apache Abdera to a actively maintained library, as the project is retired and will not receive security updates.\u003c/li\u003e\n\u003cli\u003eIf migration is not immediately possible, implement strict input validation and sanitization layers to ensure untrusted XML data does not reach the Abdera parser or its associated JDBC adapter paths.\u003c/li\u003e\n\u003cli\u003eAudit internal application dependencies to identify downstream products that may still bundle affected Apache Abdera artifacts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T17:00:46Z","date_published":"2026-10-22T17:00:46Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-abdera-xxe/","summary":"The retired Apache Abdera library is vulnerable to XML external entity (XXE) injection, enabling unauthenticated remote attackers to access sensitive files or perform server-side requests via malicious XML input.","title":"Apache Abdera: XML External Entity Injection (CVE-2026-113582)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-abdera-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:abdera:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}