Bug 2403063 (CVE-2025-53066) - CVE-2025-53066 openjdk: Enhance Path Factories (Oracle CPU 2025-10)
Summary: CVE-2025-53066 openjdk: Enhance Path Factories (Oracle CPU 2025-10)
Keywords:
Status: NEW
Alias: CVE-2025-53066
Deadline: 2025-10-21
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-10-10 11:38 UTC by OSIDB Bzimport
Modified: 2025-10-24 13:46 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-10-10 11:38:33 UTC 
XPathFactory appears vulnerable to vulnerable to XXE and XEE.
Comment 2 Michal Findra 2025-10-24 13:40:02 UTC 
OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/dde48aedce2fe649e1737b3eec829428381bcb8f

OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/2c7f45612d11199a9d5eaa6d61a2893ec4afa687

OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/770db9328cc5ad574bd61a2e42f1a4c5601c0405

OpenJDK-21 upstream commit:
https://github.com/openjdk/jdk21u/commit/bb9edcc4a43362aaa49a7b8621291c461f483e24
Comment 3 Michal Findra 2025-10-24 13:46:21 UTC 
This CVE was fixed in Oracle Java SE 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1. 

https://www.oracle.com/java/technologies/javase/8u471-relnotes.html#R180_471
https://www.oracle.com/java/technologies/javase/11-0-29-relnotes.html#R11_0_29
https://www.oracle.com/java/technologies/javase/17-0-17-relnotes.html#R17_0_17
https://www.oracle.com/java/technologies/javase/21-0-9-relnotes.html
https://www.oracle.com/java/technologies/javase/25-0-1-relnotes.html
Note You need to log in before you can comment on or make changes to this bug.