CVE-2026-61586: 
Java vulnerability analysis and mitigation

CVE-2026-61586 is an improper XInclude resource restriction vulnerability in Copernik XML Factory (Maven artifact eu.copernik:copernik-xml-factory) affecting all versions through 0.1.1. When running on the stock JDK provider (i.e., Apache Xerces is absent from the classpath), the library fails to block xi:include resolution even after an application enables XInclude via setXIncludeAware(true), breaking the library's documented security guarantee. The vulnerability was discovered by Ta Duc Thien and Duc Anh Nguyen (Danzation), first published on June 26, 2026, and added to the GitHub Advisory Database on October 2, 2026. It carries a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Security Advisory).

The root cause is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The stock JDK's XInclude processor resolves xi:include hrefs by consulting the parser's EntityResolver rather than honoring the ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_SCHEMA attributes — a behavior the library's hardening logic incorrectly relied upon. As a result, setting those attributes to empty strings (the library's prior mitigation) had no effect on XInclude resolution. Exploitation requires four concurrent conditions: (1) the application uses XmlFactories.newDocumentBuilderFactory(), XmlFactories.newSAXParserFactory(), or XmlFactories.harden() on an XMLReader; (2) Apache Xerces is not on the classpath; (3) XInclude is explicitly enabled via setXIncludeAware(true) or an equivalent reader feature; and (4) the application parses XML from an untrusted source. The fix (commits 2fa042c and e5febc6) installs a deny-all FallbackDenyResolver as a non-overridable floor on every DocumentBuilder and XMLReader produced, blocking all external resource fetches including xi:include hrefs (GitHub Commit 2fa042c, GitHub Commit e5febc6).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary local files on the server hosting the vulnerable application (information disclosure) by crafting xi:include elements with file:// hrefs, or to perform Server-Side Request Forgery (SSRF) by using http:// hrefs to probe and interact with internal network endpoints not directly accessible to the attacker. There is no integrity or availability impact — the vulnerability is confined to confidentiality. Sensitive files such as configuration files, credentials, or private keys readable by the JVM process could be exfiltrated, and SSRF could facilitate reconnaissance of internal infrastructure (GitHub Advisory, Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires specific deployment conditions (stock JDK provider, XInclude enabled, untrusted XML input), which limits the exposed population, though no authentication is required from the attacker once those conditions are met.

1. Reconnaissance: Identify applications using eu.copernik:copernik-xml-factory version ≤ 0.1.1 that accept XML input from untrusted sources (e.g., API endpoints, file upload features). Confirm that Apache Xerces (xercesImpl) is absent from the application's classpath and that XInclude is enabled.
2. Craft malicious XML payload: Construct an XML document containing an xi:include element targeting a sensitive local file or internal HTTP endpoint. For local file disclosure:

<?xml version="1.0"?>
<root xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include href="file:///etc/passwd" parse="text"/>
</root>

For SSRF:

<?xml version="1.0"?>
<root xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include href="http://169.254.169.254/latest/meta-data/" parse="text"/>
</root>

3. Submit payload: Deliver the crafted XML to the vulnerable application endpoint that parses untrusted XML (e.g., via HTTP POST, file upload, or any XML-consuming API).
4. Retrieve exfiltrated data: The application's XML parser resolves the xi:include reference and embeds the file contents or HTTP response body into the parsed document. If the application reflects parsed XML content in its response, the attacker reads the exfiltrated data directly; otherwise, out-of-band techniques (e.g., DNS or HTTP callbacks to an attacker-controlled server) may be used via the SSRF vector (GitHub Advisory, Security Advisory).

• Network: Unexpected outbound HTTP requests from the application server to internal IP ranges (e.g., RFC 1918 addresses, cloud metadata endpoints such as 169.254.169.254) originating from the JVM process; DNS lookups for internal hostnames triggered by the XML parser.
• Logs: Application or web server access logs showing XML submission to parsing endpoints followed by anomalous response content containing file data; Java exception logs referencing xi:include resolution failures (if partially blocked) or unexpected EntityResolver activity.
• File System: No direct file system artifacts are created by this vulnerability, but audit logs may show the JVM process reading sensitive files (e.g., /etc/passwd, application configuration files) outside normal operation patterns.
• Process: Unusual network connections initiated by the Java process to internal endpoints not part of normal application behavior, detectable via network monitoring tools or EDR solutions.

Upgrade eu.copernik:copernik-xml-factory to version 0.1.2, which fixes the defect by installing a deny-all FallbackDenyResolver as a non-overridable floor on all DocumentBuilder and XMLReader instances produced by the stock JDK provider (v0.1.2 Release). As an immediate workaround, add Apache Xerces (xercesImpl) to the application's classpath — the library will then select the Xerces provider, which is not affected by this vulnerability. Alternatively, avoid calling setXIncludeAware(true) on factories obtained from this library when the stock JDK provider is in use, or ensure that untrusted XML is not parsed in this configuration (Security Advisory).