Critical severity9.1NVD Advisory· Published Jan 14, 2021· Updated Jun 17, 2026
CVE-2021-23926
CVE-2021-23926
Description
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.xmlbeans:xmlbeansMaven | < 3.0.0 | 3.0.0 |
Affected products
28- cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*+ 1 more
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
- ghsa-coords16 versionspkg:maven/org.apache.xmlbeans/xmlbeanspkg:rpm/opensuse/xmlbeans&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/xmlbeans&distro=openSUSE%20Leap%2015.4pkg:rpm/suse/xmlbeans&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOSpkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCLpkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/xmlbeans&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP5pkg:rpm/suse/xmlbeans&distro=SUSE%20Manager%20Proxy%204.1pkg:rpm/suse/xmlbeans&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1pkg:rpm/suse/xmlbeans&distro=SUSE%20Manager%20Server%204.1
< 3.0.0+ 15 more
- (no CPE)range: < 3.0.0
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-3.3.1
- (no CPE)range: < 2.6.0-3.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
- (no CPE)range: < 2.6.0-150000.5.3.1
Patches
Vulnerability mechanics
References
14- www.oracle.com/security-alerts/cpujul2022.htmlnvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-mw3r-pfmg-xp92ghsaADVISORY
- issues.apache.org/jira/browse/XMLBEANS-517nvdIssue TrackingVendor AdvisoryWEB
- lists.debian.org/debian-lts-announce/2021/06/msg00024.htmlnvdMailing ListThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-23926ghsaADVISORY
- poi.apache.orgnvdProductVendor Advisory
- security.netapp.com/advisory/ntap-20210513-0004/nvdThird Party Advisory
- lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed@%3Cjava-dev.axis.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1@%3Cjava-dev.axis.apache.org%3EghsaWEB
- poi.apache.orgghsaWEB
- security.netapp.com/advisory/ntap-20210513-0004ghsaWEB
- lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3Envd
- lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3Envd
News mentions
0No linked articles in our index yet.