CVE-2025-4949
1 advisory.
Maven/org.eclipse.jgit:org.eclipse.jgit CVE-2025-4949: medium 5.3, EPSS 0.84%
Eclipse JGit XML External Entity (XXE) Vulnerability
Action: Upgrade org.eclipse.jgit:org.eclipse.jgit to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.2.0.202503040940-r | 7.2.1.202505142326-r | - |
| 7.1.0.202411261347-r | 7.1.1.202505221757-r | - |
| 7.0.0.202409031743-r | 7.0.1.202505221510-r | - |
| 6.1.0.202203080745-r | 6.10.1.202505221210-r | - |
| 6.0.0.202110060947-m1 | 6.0.0.202111291000-r | - |
| 0 | 5.13.4.202507202350-r | - |
Fixed versions
| 7.2.1.202505142326-r | 7.1.1.202505221757-r | 7.0.1.202505221510-r | 6.10.1.202505221210-r | 6.0.0.202111291000-r | 5.13.4.202507202350-r |
Sources
- osv: GHSA-vrpq-qp53-qv56
- nvd: CVE-2025-4949
- https://github.com/eclipse-jgit/jgit
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/64
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281
- https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4
- https://projects.eclipse.org/projects/technology.jgit/releases/5.13.5
- https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1
- https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1
- https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1
- https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1
CVE-2025-4949 · published · modified · JSON