CVE-2026-61586

HIGHCVSS · not yet scored
—
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No CVSS published and no exploitation signals yet
CISA-KEV: Not listedEPSS PROB: —CVSS v2: —Exploit: None knownExposed services: Not assessed

No fix is confirmed yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for the fix.

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or on an XMLReader passed through XmlFactories.harden(). The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.

An application that parses untrusted XML in this configuration can be made to resolve xi:include references, allowing an attacker to read local files (information disclosure) or, through http hrefs, reach internal network endpoints (SSRF).

All of the following conditions must hold for an application to be affected:

  • it obtains a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or hardens an externally obtained XMLReader with XmlFactories.harden();
  • the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath;
  • XInclude is enabled, by calling setXIncludeAware(true) or the equivalent reader feature;
  • it parses XML from an untrusted source.

The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.

Applications are advised to upgrade to 0.1.2, which fixes the defect. As a workaround add Apache Xerces (xercesImpl) to the classpath so the library selects its unaffected Xerces provider.

Acknowledgements

The maintainer thank the following people for finding, reporting, and helping to remediate this issue:

  • Finders: Ta Duc Thien and Duc Anh Nguyen (Danzation)
  • Remediation developer: Ta Duc Thien
  • Tooling: Claude Code (Anthropic), Claude Opus 4.8

CVSS v3
—
EchelonGraph score
Not yet assessedNo source has published severity data for this CVE yet — no CVSS score from NVD or a CNA, no GitHub advisory, and it is not in CISA KEV. This is not a rating of zero; we cannot assess it yet.
EG Score
—
EG Risk
—
EPSS PROB
—
EPSS %ILE
—
KEV
Not listed

Published

October 2, 2026

Last Modified

October 2, 2026

Vendor Advisories for CVE-2026-61586(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(1 across 1 ecosystem)
Maven(1)
PackageVulnerable rangeFix by version rangeDependents
eu.copernik:copernik-xml-factory0.1.0, 0.1.1
  • every version up to 0.1.2: fixed in 0.1.2
—

Data Freshness Timeline

(refreshed 1× in last 7d / 1× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-10-02 18:46 UTCEG score recompute

Frequently asked(3)

What is CVE-2026-61586?
CVE-2026-61586 is a high vulnerability published on October 2, 2026. Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by…
When was CVE-2026-61586 disclosed?
CVE-2026-61586 was first published on October 2, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
How do I remediate CVE-2026-61586?
No fix for CVE-2026-61586 is confirmed yet. Until one is published, restrict network exposure of the affected system or apply the vendor's mitigation — for example, keep it off the internet or limit it to trusted networks — and watch the vendor's advisory for the fix. The vendor advisories EchelonGraph has for CVE-2026-61586 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-61586

Explore →

Is Your Infrastructure Affected by CVE-2026-61586?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs