CVE-2026-22016

A flaw was found in openjdk. When compiling XPath expressions, the internal XML security manager is not properly initialized, failing to restrict external entity resolution. A remote attacker could exploit this vulnerability by supplying specially crafted XML input to trigger XML External Entity (XXE) injection or XML Entity Expansion (XEE). Successful exploitation primarily leads to unauthorized information disclosure, such as the exposure of sensitive local files, and can also cause a Denial of Service (DoS) through resource exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.