CVE catalog

CVE-2025-4949

jgit: CVE-2025-4949

Severity: Medium · CVSS 4.8CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Published: May 21, 2025, 6:47:19 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.84% · Oct 25, 2026

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	jgit	sid	`6.7.0-2`	vulnerable
Debian	jgit	forky	`6.7.0-2`	vulnerable
Debian	jgit	trixie	`6.7.0-2`	vulnerable
Debian	jgit	bookworm	`4.11.9-2`	vulnerable
Suse	jgit	linux enterprise module for development tools 15 sp6	`5.11.0-150200.3.23.1`	fixed
Suse	jgit	linux enterprise module for development tools 15 sp7	`5.11.0-150200.3.23.1`	fixed
Opensuse	eclipse-jgit	leap 15.6	`5.11.0-150200.3.23.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	jgit	source	sid	`(unfixed)`	not yet assigned	Not reported	[1106287]
Debian	jgit	source	forky	`(unfixed)`	not yet assigned	Not reported	[1106287]
Debian	jgit	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1106287]
Debian	jgit	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1106287]
Suse	jgit	rpm	linux enterprise module for development tools 15 sp6	`5.11.0-150200.3.23.1`	Not reported	SUSE-SU-2025:02762-1	Not reported
Suse	jgit	rpm	linux enterprise module for development tools 15 sp7	`5.11.0-150200.3.23.1`	Not reported	SUSE-SU-2025:02762-1	Not reported
Opensuse	eclipse-jgit	rpm	leap 15.6	`5.11.0-150200.3.23.1`	Not reported	SUSE-SU-2025:02762-1	Not reported

[Debian bug #1106287]

Notes

[trixie] jgit: Minor issue [bookworm] jgit: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[jgit-cli]Affected
Source package: [jgit]
Details (2)
- 4.11.9-2 · all · bookworm
  Affected
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
- 4.11.9-2 · all · bookworm
  Affected
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
[libjgit-ant-java]Affected
Source package: [jgit]
Details (2)
- 4.11.9-2 · all · bookworm
  Affected
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
- 4.11.9-2 · all · bookworm
  Affected
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
[libjgit-java]Affected
Source package: [jgit]
Details (2)
- 4.11.9-2 · all · bookworm
  Affected
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
- 4.11.9-2 · all · bookworm
  Affected
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12

[Debian 13 (Trixie)]

[jgit-cli]Affected
Source package: [jgit]
Details (2)
- 6.7.0-2 · all · trixie
  Affected
  dsa · jgit · debian · 13
- 6.7.0-2 · all · trixie
  Affected
  dsa · jgit · debian · 13
[libjgit-ant-java]Affected
Source package: [jgit]
Details (2)
- 6.7.0-2 · all · trixie
  Affected
  dsa · jgit · debian · 13
- 6.7.0-2 · all · trixie
  Affected
  dsa · jgit · debian · 13
[libjgit-java]Affected
Source package: [jgit]
Details (2)
- 6.7.0-2 · all · trixie
  Affected
  dsa · jgit · debian · 13
- 6.7.0-2 · all · trixie
  Affected
  dsa · jgit · debian · 13

Observed: Oct 24, 2026, 10:06:02 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]