CVE catalog

CVE-2021-39239

apache-jena: CVE-2021-39239

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
4.34% · Oct 25, 2026

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianapache-jenasid4.9.0-1fixed
Debianapache-jenaforky4.9.0-1fixed
Debianapache-jenatrixie4.9.0-1fixed
Debianapache-jenabookworm4.5.0-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianapache-jenasourcesid4.5.0-1not yet assignedNot reported[1014982]
Debianapache-jenasourceforky4.5.0-1not yet assignedNot reported[1014982]
Debianapache-jenasourcetrixie4.5.0-1not yet assignedNot reported[1014982]
Debianapache-jenasourcebookworm4.5.0-1not yet assignedNot reported[1014982]

[Debian bug #1014982]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache-jena-java]Fixed

    Source package: [apache-jena]

    Details (2)

    • 4.5.0-2 · all · bookworm

      Fixed · Fixed: 4.5.0-1

      dsa · apache-jena · debian · bookworm; dsa · apache-jena · debian · 12

    • 4.5.0-2 · all · bookworm

      Fixed · Fixed: 4.5.0-1

      dsa · apache-jena · debian · bookworm; dsa · apache-jena · debian · 12

[Debian 13 (Trixie)]

  • [libapache-jena-java]Fixed

    Source package: [apache-jena]

    Details (2)

    • 4.9.0-1 · all · trixie

      Fixed · Fixed: 4.5.0-1

      dsa · apache-jena · debian · 13

    • 4.9.0-1 · all · trixie

      Fixed · Fixed: 4.5.0-1

      dsa · apache-jena · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]