CVE-2026-54079: Java Insecure Documentbuilderfactory Chaining
Chaining `DocumentBuilderFactory.newInstance().newDocumentBuilder()` prevents secure configuration of the XML parser, leaving it vulnerable to XML External Entity (XXE) injection. Instantiate the factory separately and disable DTDs and external entities before creating the DocumentBuilder.
Javagreprules fetch cve-2026-54079-java-insecure-documentbuilderfactory-chaining --engine opengrepDescription
Chaining `DocumentBuilderFactory.newInstance().newDocumentBuilder()` prevents secure configuration of the XML parser, leaving it vulnerable to XML External Entity (XXE) injection. Instantiate the factory separately and disable DTDs and external entities before creating the DocumentBuilder.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.