CVE-2025-4949

Name of the Vulnerable Software and Affected Versions Eclipse JGit versions 7.2.0.202503040940-r and older

Description The ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This can lead to information disclosure, denial of service, and other security issues.

Recommendations For Eclipse JGit versions 7.2.0.202503040940-r and older, consider disabling the ManifestParser class and the AmazonS3 class until a patch is available. Restrict access to the experimental amazons3 git transport protocol to minimize the risk of exploitation. Avoid using the affected classes for parsing XML files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.