CVE-2026-61586

Name of the Vulnerable Software and Affected Versions Copernik XML Factory versions prior to 0.1.2

Description When using the stock JDK provider (where Apache Xerces is absent from the classpath), the software fails to block XInclude resource resolution if an application enables XInclude. This occurs when using factories from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or when an XMLReader is processed via XmlFactories.harden(). An attacker providing untrusted XML can use xi:include references to disclose local files or perform server-side request forgery (SSRF) to reach internal network endpoints via http references. SSRF is a technique where an attacker induces a server-side application to make requests to an unintended location.

Recommendations Update to version 0.1.2. Add Apache Xerces (xercesImpl) to the classpath to ensure the unaffected Xerces provider is selected.