Answer in brief
CVE-2026-54079 records a High severity ssrf vulnerability in veraPDF Validation XXE via XFA. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Answer in brief
CVE-2026-54079 records a High severity ssrf vulnerability in veraPDF Validation XXE via XFA. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Update org.verapdf:validation-model to 1.30.2; org.verapdf:validation-model to 1.31.71; org.verapdf:validation-model-jakarta to 1.30.2; org.verapdf:validation-model-jakarta to 1.31.71 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSSRF describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54079 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| org.verapdf:validation-modelmaven | >=1.17.35,<=1.30.1 | 1.30.2 |
| org.verapdf:validation-modelmaven | >=1.31.1,<=1.31.70 | 1.31.71 |
| org.verapdf:validation-model-jakartamaven | >=1.17.35,<=1.30.1 | 1.30.2 |
| org.verapdf:validation-model-jakartamaven | >=1.31.1,<=1.31.70 | 1.31.71 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54079 records a High severity ssrf vulnerability in veraPDF Validation XXE via XFA. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for org.verapdf:validation-model, org.verapdf:validation-model, org.verapdf:validation-model-jakarta.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate org.verapdf:validation-model to 1.30.2; org.verapdf:validation-model to 1.31.71; org.verapdf:validation-model-jakarta to 1.30.2; org.verapdf:validation-model-jakarta to 1.31.71 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSSRF describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54079 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| org.verapdf:validation-modelmaven | >=1.17.35,<=1.30.1 | 1.30.2 |
| org.verapdf:validation-modelmaven | >=1.31.1,<=1.31.70 | 1.31.71 |
| org.verapdf:validation-model-jakartamaven | >=1.17.35,<=1.30.1 | 1.30.2 |
| org.verapdf:validation-model-jakartamaven | >=1.31.1,<=1.31.70 | 1.31.71 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54079 records a High severity ssrf vulnerability in veraPDF Validation XXE via XFA. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for org.verapdf:validation-model, org.verapdf:validation-model, org.verapdf:validation-model-jakarta.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation. ## Details The vulnerability resides in veraPDF-validation `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` within the `getdynamicRender()` method. This method retrieves the /XFA entry from the PDF's /AcroForm dictionary, decodes the embedded XML stream, and parses it to extract the `<dynamicRender>` element value. The vulnerability stems from the use of a default-configured `DocumentBuilderFactory` to parse fully attacker-controlled XML: - The factory is created via `DocumentBuilderFactory.newInstance()` with no security features enabled. disallow-doctype-decl, external-general-entities, external-parameter-entities, and FEATURE_SECURE_PROCESSING are all left at their insecure defaults. - The input passed to `builder.parse()` is the decoded /XFA stream taken directly from the untrusted PDF. - The text content of the `<dynamicRender>` node is returned to the validation model. Note that the shipped PDF/UA-1 rule (`dynamicRender != 'required'`) consumes this value but does not echo it into the report output, so reliable exfiltration requires the out-of-band parameter-entity technique described under Impact rather than in-band reflection. ## Impact This impacts all current releases of the veraPDF validation-model module. Successful exploitation requires only that the target validate an attacker-supplied PDF against the PDF/UA-1 profile (or via flavour auto-detection on a PDF that declares PDF/UA-1 conformance), since `getdynamicRender()` is invoked by the `dynamicRender != 'required'` rule in the bundled PDF/UA-1 profile. No additional configuration or operator action is required. ## Proposed Patch Harden the `DocumentBuilderFactory` in `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` per the OWASP XXE Prevention Cheat Sheet to disallow DOCTYPE outright.
## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation. ## Details The vulnerability resides in veraPDF-validation `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` within the `getdynamicRender()` method. This method retrieves the /XFA entry from the PDF's /AcroForm dictionary, decodes the embedded XML stream, and parses it to extract the `<dynamicRender>` element value. The vulnerability stems from the use of a default-configured `DocumentBuilderFactory` to parse fully attacker-controlled XML: - The factory is created via `DocumentBuilderFactory.newInstance()` with no security features enabled. disallow-doctype-decl, external-general-entities, external-parameter-entities, and FEATURE_SECURE_PROCESSING are all left at their insecure defaults. - The input passed to `builder.parse()` is the decoded /XFA stream taken directly from the untrusted PDF. - The text content of the `<dynamicRender>` node is returned to the validation model. Note that the shipped PDF/UA-1 rule (`dynamicRender != 'required'`) consumes this value but does not echo it into the report output, so reliable exfiltration requires the out-of-band parameter-entity technique described under Impact rather than in-band reflection. ## Impact This impacts all current releases of the veraPDF validation-model module. Successful exploitation requires only that the target validate an attacker-supplied PDF against the PDF/UA-1 profile (or via flavour auto-detection on a PDF that declares PDF/UA-1 conformance), since `getdynamicRender()` is invoked by the `dynamicRender != 'required'` rule in the bundled PDF/UA-1 profile. No additional configuration or operator action is required. ## Proposed Patch Harden the `DocumentBuilderFactory` in `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` per the OWASP XXE Prevention Cheat Sheet to disallow DOCTYPE outright.