CVE-2026-15803

The critical finding in CVE-2026-15803 isn't the XXE vulnerability itself—it's that CVE-2018-1000644 was incompletely patched, suggesting a systemic failure to address unsafe XML parsing at the architectural level rather than fixing individual code paths. The original fix covered only a subset of parser entry points, leaving 'several' entry points unprotected. This points to a patch applied under deadline pressure that addressed symptoms, not root causes. The correct remediation for Java XXE is disabling DOCTYPE declarations and external entities at the parser factory level—ensuring all code paths inherit secure defaults regardless of which method handles incoming XML. The phrase 'rejects or disables by default' in the current fix warrants scrutiny: it implies opt-out capability, meaning applications needing legitimate DTD processing could re-enable vulnerable behavior. If the documentation for re-enabling DTDs is sparse, developers will fumble into insecure configurations without realizing it. The blast radius extends beyond the parser itself. RDF4J is a data ingestion chokepoint—wherever parsed RDF flows next (graph databases, search indexes, policy engines) becomes reachable through XXE-induced SSRF. File disclosure is bounded; SSRF opens your internal network topology to an attacker who already has a parsing foothold. Worse, the 2018 patch created a false sense of security. Every organization that updated to the 'fixed' version stopped hunting for XXE in RDF4J. Defenders mentally closed the case, scanners stopped flagging the code path, and reviewers stopped scrutinizing XML parser instantiation in pull requests. The incomplete fix didn't just leave a technical gap—it created a negative knowledge state that actively suppressed future hunting. The window between 2018 and this disclosure likely saw higher exploitation probability precisely because defenders believed they were protected. Harden XML parsing at the factory level across all entry points, audit for any code that re-enables DTD processing, and assume the 2018–2026 window may have been actively exploited in targeted attacks.

Reviewed through automated stages and approved by a human before publication.