CVE catalog

CVE-2025-53689

jackrabbit: CVE-2025-53689

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.54% · Oct 25, 2026

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjackrabbitsid2.20.11-1.1fixed
Debianjackrabbitforky2.20.11-1.1fixed
Debianjackrabbittrixie2.20.11-1.1fixed
Debianjackrabbitbookworm2.20.3-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjackrabbitsourcesid2.20.11-1.1unimportantNot reported[1109335]
Debianjackrabbitsourceforky2.20.11-1.1unimportantNot reported[1109335]
Debianjackrabbitsourcetrixie2.20.11-1.1unimportantNot reported[1109335]
Debianjackrabbitsourcebookworm(unfixed)unimportantNot reported[1109335]

[Debian bug #1109335]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjackrabbit-java]Affected

    Source package: [jackrabbit]

    Details (2)

    • 2.20.3-1 · all · bookworm

      Affected

      dsa · jackrabbit · debian · bookworm; dsa · jackrabbit · debian · 12

    • 2.20.3-1 · all · bookworm

      Affected

      dsa · jackrabbit · debian · bookworm; dsa · jackrabbit · debian · 12

[Debian 13 (Trixie)]

  • [libjackrabbit-java]Fixed

    Source package: [jackrabbit]

    Details (2)

    • 2.20.11-1.1 · all · trixie

      Fixed · Fixed: 2.20.11-1.1

      dsa · jackrabbit · debian · 13

    • 2.20.11-1.1 · all · trixie

      Fixed · Fixed: 2.20.11-1.1

      dsa · jackrabbit · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]