Medium Jgit CVEs

Protected by Waratek 1 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 1 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 100.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

May 251 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1

May 25

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2025-4949	Medium	2025-05-21	Protected by Waratek	Proof of concept only	In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2025-4949

Medium

2025-05-21

Protected by Waratek

Proof of concept only

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.