Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-4949

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Published

2025-05-21T07:16:01.397

Last Modified

2025-10-16T14:49:42.353

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Secondary
CWE-611
CWE-827
Type: Primary
CWE-611

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	eclipse	jgit	< 5.13.4	Yes
Application	eclipse	jgit	< 6.10.1.202505221210	Yes
Application	eclipse	jgit	< 7.0.1.202505221510	Yes
Application	eclipse	jgit	< 7.1.1.202505221757	Yes
Application	eclipse	jgit	< 7.2.1.202505142326	Yes

References

https://gitlab.eclipse.org/security/cve-assignement/-/issues/64 Issue Tracking, Vendor Advisory ([email protected])
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281 Exploit, Issue Tracking ([email protected])
https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4 Release Notes ([email protected])
https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1 Release Notes ([email protected])
https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1 Release Notes ([email protected])
https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1 Release Notes ([email protected])
https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1 Release Notes ([email protected])
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281 Exploit, Issue Tracking (134c704f-9b21-4f2e-91b3-4a467353bcc0)