Apache Jackrabbit vulnerabilities

2 known vulnerabilities in Apache Jackrabbit from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Apache Jackrabbit: Session Fixation

  CVE-2026-92414Oct 7, 2026Apache

  : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue

• 8.8 High severity

  Apache Jackrabbit: Improper Restriction of XML External Entity Reference

  CVE-2025-53689Jul 14, 2025Apache

  Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Jav