In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6011 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.17 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.3.16, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.17 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection     (CVE-2026-0603)

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit (CVE-2025-4949)

    * undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded     (CVE-2024-3884)

    * cxf: CXF JMS Code Execution Vulnerability (CVE-2025-48913)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4916 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.24 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.4.23, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.24 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)

    * undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache     Poisoning and SSRF [eap-7.4.z] (CVE-2025-12543)

    * cxf: CXF JMS Code Execution Vulnerability [eap-7.4.z] (CVE-2025-48913)

    * netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-55163)

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-7.4.z] (CVE-2025-4949)

    * hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection     [eap-7.4.z] (CVE-2026-0603)

    * com.google.protobuf/protobuf-java: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)

    * undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded [eap-7.4.z]     (CVE-2024-3884)

    * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4917 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.24 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.4.23, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.24 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)

    * undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache     Poisoning and SSRF [eap-7.4.z] (CVE-2025-12543)

    * cxf: CXF JMS Code Execution Vulnerability [eap-7.4.z] (CVE-2025-48913)

    * netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-55163)

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-7.4.z] (CVE-2025-4949)

    * hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection     [eap-7.4.z] (CVE-2026-0603)

    * com.google.protobuf/protobuf-java: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)

    * undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded [eap-7.4.z]     (CVE-2024-3884)

    * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4915 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.24 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.4.23, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.24 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)

    * undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache     Poisoning and SSRF [eap-7.4.z] (CVE-2025-12543)

    * cxf: CXF JMS Code Execution Vulnerability [eap-7.4.z] (CVE-2025-48913)

    * netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-55163)

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-7.4.z] (CVE-2025-4949)

    * hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection     [eap-7.4.z] (CVE-2026-0603)

    * com.google.protobuf/protobuf-java: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)

    * undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded [eap-7.4.z]     (CVE-2024-3884)

    * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22775 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.11 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.0.10, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.11 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded [eap-8.0.z]     (CVE-2024-3884)

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.0.z] (CVE-2025-4949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22773 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.11 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.0.10, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.11 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded [eap-8.0.z]     (CVE-2024-3884)

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.0.z] (CVE-2025-4949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22187 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.2 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.1, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.2 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.1.z] (CVE-2025-4949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22188 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.2 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.1, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.2 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.1.z] (CVE-2025-4949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the SQLcl (jgit) component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Difficult to exploit vulnerability allows low privileged attacker having Valid     account privilege with network access via HTTP to compromise SQLcl (jgit). Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in unauthorized access to critical data or complete access to all SQLcl (jgit) accessible data.
    (CVE-2025-4949)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with logon to the infrastructure where RDBMS (Python) executes to     compromise RDBMS (Python). Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of RDBMS (Python).
    (CVE-2024-12254, CVE-2024-12718, CVE-2024-6923, CVE-2024-8088, CVE-2025-1795, CVE-2025-4138,     CVE-2025-4330, CVE-2025-4435, CVE-2025-4517)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19.3-19.28, 21.3-21.19 and 23.4-23.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Java VM     accessible data. (CVE-2025-61881)

  - Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are     affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows unauthenticated     attacker with network access via Bonjour to compromise Portable Clusterware. While the vulnerability is in     Portable Clusterware, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Portable Clusterware     accessible data. (CVE-2025-53047)

  - Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Easily exploitable vulnerability allows high privileged attacker having DBA     privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit     accessible data. (CVE-2025-61749)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command     and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to     store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when     parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other     security issues. (CVE-2025-4949)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command
    and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to
    store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when
    parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other
    security issues. (CVE-2025-4949)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02762-1 advisory.

    - CVE-2025-4949: Fixed the XXE vulnerability in ManifestParser and AmazonS3 class (bsc#1243647).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
304302	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.17 (RHSA-2026:6011)	Nessus	Red Hat Local Security Checks	Local	medium
302900	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.24 (RHSA-2026:4916)	Nessus	Red Hat Local Security Checks	Local	high
302899	RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.24 (RHSA-2026:4917)	Nessus	Red Hat Local Security Checks	Local	high
302898	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.24 (RHSA-2026:4915)	Nessus	Red Hat Local Security Checks	Local	high
277503	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.0.11 (RHSA-2025:22775)	Nessus	Red Hat Local Security Checks	Local	medium
277474	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.11 (RHSA-2025:22773)	Nessus	Red Hat Local Security Checks	Local	medium
277218	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.2 (RHSA-2025:22187)	Nessus	Red Hat Local Security Checks	Local	medium
277205	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.1.2 Security update (Moderate) (RHSA-2025:22188)	Nessus	Red Hat Local Security Checks	Local	medium
271256	Oracle Database Server (October 2025 CPU)	Nessus	Databases	Local	high
259091	Linux Distros Unpatched Vulnerability : CVE-2025-4949	Nessus	Misc.	Local	medium
434785	SCA: security update for org.eclipse.jgit:org.eclipse.jgit (GHSA-vrpq-qp53-qv56)	Tenable Cloud Security	SCA Checks	Local	medium
434785	SCA: security update for org.eclipse.jgit:org.eclipse.jgit (GHSA-vrpq-qp53-qv56)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
249214	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : eclipse-jgit (SUSE-SU-2025:02762-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2025-4949

medium

Tenable Plugins

medium

high

high

high

medium

medium

medium

medium

high

medium

medium

medium

medium