CVE-2026-108086 in Cocoon
Summary
by MITRE • 10/20/2026
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon.
This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The Apache Cocoon framework contains a critical XML External Entity (XXE) vulnerability, specifically classified as Improper Restriction of Recursive Entity References within Document Type Definitions. This flaw manifests in the fp form processor component and allows an attacker to inject malicious DTDs that define recursive or external entity references. When the application parses untrusted XML input containing these crafted entities, it expands them excessively during processing. This behavior is commonly referred to as XML Entity Expansion or Billion Laughs attack variant when used for denial of service, but in this specific context involving the form processor, it facilitates more severe remote attacks such as Server-Side Request Forgery SSRF and arbitrary file disclosure. The vulnerability stems from a failure to properly validate or restrict external entity declarations before they are processed by the underlying XML parser library utilized by Cocoon.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and network reconnaissance. By leveraging the XXE flaw, an authenticated or unauthenticated attacker depending on access controls can force the server to make HTTP requests to internal services that are not directly accessible from the internet. This SSRF capability allows attackers to probe internal networks identify running services and potentially exploit other vulnerabilities within those internal systems. Furthermore the vulnerability enables reading arbitrary files from the local file system of the host machine where Apache Cocoon is deployed. Sensitive configuration files source code credentials or database dumps can be read by referencing them via file URIs in the malicious XML payload. This leads to a complete compromise of confidentiality and potentially integrity if combined with other attack vectors such as remote code execution through log poisoning techniques which are often associated with XXE vulnerabilities.
From a classification perspective this vulnerability aligns with CWE-611 Improper Restriction of XML External Entity Reference and is frequently exploited using techniques documented in the MITRE ATT&CK framework under T1059 Command Line Interface or T1078 Valid Accounts if authentication bypasses are involved for initial access. The exploitation path typically involves sending a specially crafted HTTP POST request to the form processing endpoint with an XML body containing external entity definitions that point to internal resources or local files. Since Apache Cocoon is designed to process user-submitted forms this attack vector is particularly dangerous as it targets a core functionality of the application where input validation might be less rigorous than in other parts of the system.
Given that Apache Cocoon has been retired and no security patches are planned by the maintainers remediation must rely on architectural changes rather software updates. The primary recommendation is to migrate away from Apache Cocoon to actively maintained alternatives such as Spring MVC or Struts which have robust built-in protections against XXE when configured correctly. If migration is not immediately feasible organizations should implement strict input validation and sanitization at the network perimeter using Web Application Firewalls WAFs that can detect and block XML entity expansion patterns. Additionally deploying runtime application self-protection RASP solutions can help identify and terminate processes exhibiting abnormal memory usage or excessive parsing activity indicative of XXE attacks. Access controls must be tightened to ensure only trusted users interact with form processing endpoints reducing the attack surface significantly.
To mitigate the risk in legacy environments administrators should configure the underlying XML parser to disable DTDs entirely if they are not strictly required for business logic. This can often be achieved by setting specific features on the SAXParserFactory or DocumentBuilderFactory instances such as disabling external general entities and external parameter entities. However since this requires code-level changes which may not be feasible in a retired project network level mitigation remains the most practical defense strategy. Monitoring logs for unusual spikes in CPU memory usage or outbound HTTP requests from the application server can also provide early detection of active exploitation attempts allowing security teams to respond before significant data loss occurs.