CVE-2025-4949

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-611 CWE-827

Affected software

Vendor	Product	Versions
Eclipse JGit	Eclipse JGit	>= 7.2.0, < 7.2.1.202505142326-r; >= 7.1.0, < 7.1.1.202505221757-r; >= 7.0.0, < 7.0.1.202505221510-r; < 5.13.4.202507202350-r; >= 6.0.0, < 6.10.1.202505221210-r
Eclipse JGit	Eclipse JGit	>= 7.2.0, < 7.2.1.202505142326-r; >= 7.1.0, < 7.1.1.202505221757-r; >= 7.0.0, < 7.0.1.202505221510-r; < 5.13.4.202507202350-r; >= 6.0.0, < 6.10.1.202505221210-r

References

https://gitlab.eclipse.org/security/cve-assignement/-/issues/64Issue Tracking, Vendor Advisory
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281Exploit, Issue Tracking
https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1Release Notes
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281Exploit, Issue Tracking

Timeline

Published: May 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-494905.3Resource leak vulnerability in ASR180x in router allows Resource Leak Exposure. This vulnerability is associated with program files router CVE-2025-494915.3Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (traffic_stat modules) allows Resourc CVE-2025-494929.8Out-of-bounds write in ASR180x in lte-telephony, May cause a buffer underrun. This vulnerability is associated with program files apps/atc CVE-2025-494935.8Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.CVE-2025-494947.5An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 9110, Modem 51 CVE-2025-494958.4An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580. Mishandling of an NL80211 vendor comma CVE-2025-495067.5APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons CVE-2025-495079.8Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a CVE-2025-495088.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay CVE-2025-495095.3Missing Authorization vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Exploiting Incorrectly Configur CVE-2025-49514.6Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field CVE-2025-495104.3Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-wooco