CVE-2026-113582: Apache Abdera XML External Entity (XXE) Vulnerabilities
2026-10-24
During research at Addepar, I discovered XML External Entity (XXE) vulnerabilities in the Apache Abdera library. All versions of the library are affected. I reported the vulnerablities to Apache Security who allocated and published CVE-2026-113582 for tracking. The severity is rated 8.7 (high) per CVSS 4.0.
Abdera is an open source Atom implementation. The project has been unmaintained since February 2017. No patches will be provided.