VIR Vulnerability Intelligence Relay

CVE-2025-4949

unknown
Published 2025-05-21 · Modified 2026-02-04
CVSS v3
—
CVSS v2
—
VIR risk
—

Description

Eclipse JGit XML External Entity (XXE) Vulnerability

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2025-4949.html

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2025-4949

OS impact
OSVersionStatusFixed in
debian debianbookwormaffected
debian debianbullseyeaffected
debian debianforkyaffected
debian debiansidaffected
debian debiantrixieaffected
suse slesaffected

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.eclipse.jgit:org.eclipse.jgit>=7.2.0.202503040940-r,<7.2.1.202505142326-r7.2.1.202505142326-r
java Mavenorg.eclipse.jgit:org.eclipse.jgit>=7.1.0.202411261347-r,<7.1.1.202505221757-r7.1.1.202505221757-r
java Mavenorg.eclipse.jgit:org.eclipse.jgit>=7.0.0.202409031743-r,<7.0.1.202505221510-r7.0.1.202505221510-r
java Mavenorg.eclipse.jgit:org.eclipse.jgit>=6.1.0.202203080745-r,<6.10.1.202505221210-r6.10.1.202505221210-r
java Mavenorg.eclipse.jgit:org.eclipse.jgit>=6.0.0.202110060947-m1,<6.0.0.202111291000-r6.0.0.202111291000-r
java Mavenorg.eclipse.jgit:org.eclipse.jgit<5.13.4.202507202350-r5.13.4.202507202350-r

References

Verify integrity in audit chain (admin only). AS-IS.