What is GHSA-6xq8-pvg4-3mf3?

GHSA-6xq8-pvg4-3mf3 is a security advisory published by GitHub Security Advisories with Critical severity. Eclipse RDF4j vulnerable to XML External Entity

Which CVE IDs does GHSA-6xq8-pvg4-3mf3 cover?

GHSA-6xq8-pvg4-3mf3 covers the following CVE IDs: CVE-2018-1000644. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6xq8-pvg4-3mf3?

GHSA-6xq8-pvg4-3mf3 has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-6xq8-pvg4-3mf3?

GHSA-6xq8-pvg4-3mf3 affects 1 product, including: maven/org.eclipse.rdf4j:rdf4j-runtime:\u003c 2.4.0.

GHSA-6xq8-pvg4-3mf3CriticalCVSS 10.0

Eclipse RDF4j vulnerable to XML External Entity

Vendor

GitHub Security Advisories

Published

October 19, 2018

Last Modified

October 15, 2025

🔗 CVE IDs covered (1)

CVE-2018-1000644 →

📋 Description

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.

🎯 Affected products1

maven/org.eclipse.rdf4j:rdf4j-runtime:< 2.4.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000644
https://github.com/eclipse/rdf4j/issues/1056
https://github.com/advisories/GHSA-6xq8-pvg4-3mf3
https://0dd.zone/2018/08/05/rdf4j-XXE