How severe is CVE-2026-61586?

No CVSS score has been assigned to CVE-2026-61586 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-61586?

CVE-2026-61586 affects the following packages: eu.copernik:copernik-xml-factory (Maven). Ecosystems affected: Maven.

How do I fix CVE-2026-61586?

Update eu.copernik:copernik-xml-factory to 0.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-61586 is resolved across your whole dependency graph.

How do I detect CVE-2026-61586 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for eu.copernik:copernik-xml-factory, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-61586 if there is no patch (or I can't update yet)?

Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Is CVE-2026-61586 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-61586 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was CVE-2026-61586 published, and has it been updated?

CVE-2026-61586 was published on October 2, 2026 and was last updated on October 2, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕ Maven

Not in CISA KEV

CVE-2026-61586 — copernik-xml-factory

Fix: copernik-eu/copernik-xml-factory@2fa042c

CVE-2026-61586 is a security vulnerability in eu.copernik:copernik-xml-factory. A fix is available for eu.copernik:copernik-xml-factory — see the affected versions and patch details below.

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

Published

Oct 2, 2026

Updated

Oct 2, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 2, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

☕eu.copernik:copernik-xml-factory

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or on an XMLReader passed through XmlFactories.harden(). The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.

An application that parses untrusted XML in this configuration can be made to resolve xi:include references, allowing an attacker to read local files (information disclosure) or, through http hrefs, reach internal network endpoints (SSRF).

All of the following conditions must hold for an application to be affected:

it obtains a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or hardens an externally obtained XMLReader with XmlFactories.harden();
the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath;
XInclude is enabled, by calling setXIncludeAware(true) or the equivalent reader feature;
it parses XML from an untrusted source.

The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.

Applications are advised to upgrade to 0.1.2, which fixes the defect. As a workaround add Apache Xerces (xercesImpl) to the classpath so the library selects its unaffected Xerces provider.

Acknowledgements

The maintainer thank the following people for finding, reporting, and helping to remediate this issue:

Finders: Ta Duc Thien and Duc Anh Nguyen (Danzation)
Remediation developer: Ta Duc Thien
Tooling: Claude Code (Anthropic), Claude Opus 4.8

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`eu.copernik:copernik-xml-factory`	all versions	0.1.2`eu.copernik:copernik-xml-factory:0.1.2`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for eu.copernik:copernik-xml-factory, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update eu.copernik:copernik-xml-factory to 0.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-61586 is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Frequently Asked Questions

Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider. An application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files

O3 Security · Impact-Aware SCA

Is CVE-2026-61586 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works