CVE-2025-53066

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

A moderate severity flaw was found in the Java API for XML Processing (JAXP) in OpenJDK as shipped in Red Hat Enterprise Linux and the Red Hat Build of OpenJDK. When applications evaluated XML through the javax.xml.xpath.XPathFactory APIs, the configured external entity access restrictions and secure processing settings were not enforced on the underlying XML parser. An unauthenticated remote attacker who can supply untrusted XML to an application that processes it with the affected APIs, for example a web service that feeds user-supplied data to these APIs, could use crafted XML with external entities (XXE) or excessive entity expansion (XEE) to read data accessible to the Java process or affect its availability. The java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, and java-25-openjdk packages in Red Hat Enterprise Linux 7 through 10, the IBM and Semeru Java builds, and the Red Hat Build of OpenJDK 8, 11, 17, and 21 streams are affected; resolution is delegated to the responsible Red Hat Java maintenance streams, which are pursuing and delivering fixes for the affected products, while older out-of-support streams are not slated to receive them. The Red Hat Enterprise Linux 9.7.z and 10.1.z streams marked not affected already contain the fix, so the vulnerable code is not present there. Red Hat Product Security rates this flaw moderate rather than the upstream important severity because exploitation requires an application to pass attacker-controlled XML to the affected JAXP APIs, giving the attack high complexity, and the expected confidentiality and availability impacts are limited in typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.