Answer in brief
CVE-2026-54082 records a Medium severity security vulnerability in veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Answer in brief
CVE-2026-54082 records a Medium severity security vulnerability in veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Update org.verapdf:validation-model to 1.30.2; org.verapdf:validation-model to 1.31.71; org.verapdf:validation-model-jakarta to 1.30.2; org.verapdf:validation-model-jakarta to 1.31.71 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54082 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| org.verapdf:validation-modelmaven | >=1.17.35,<=1.30.1 | 1.30.2 |
| org.verapdf:validation-modelmaven | >=1.31.1,<=1.31.70 | 1.31.71 |
| org.verapdf:validation-model-jakartamaven | >=1.17.35,<=1.30.1 | 1.30.2 |
| org.verapdf:validation-model-jakartamaven | >=1.31.1,<=1.31.70 | 1.31.71 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54082 records a Medium severity security vulnerability in veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for org.verapdf:validation-model, org.verapdf:validation-model, org.verapdf:validation-model-jakarta.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate org.verapdf:validation-model to 1.30.2; org.verapdf:validation-model to 1.31.71; org.verapdf:validation-model-jakarta to 1.30.2; org.verapdf:validation-model-jakarta to 1.31.71 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54082 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| org.verapdf:validation-modelmaven | >=1.17.35,<=1.30.1 | 1.30.2 |
| org.verapdf:validation-modelmaven | >=1.31.1,<=1.31.70 | 1.31.71 |
| org.verapdf:validation-model-jakartamaven | >=1.17.35,<=1.30.1 | 1.30.2 |
| org.verapdf:validation-model-jakartamaven | >=1.31.1,<=1.31.70 | 1.31.71 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54082 records a Medium severity security vulnerability in veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for org.verapdf:validation-model, org.verapdf:validation-model, org.verapdf:validation-model-jakarta.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Summary veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and `GFPDAcroForm.getdynamicRender()`). A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values or XFA configurations, allowing local file disclosure and potentially outbound network requests depending on the runtime (host) environment. ### Details Consumers that utilise either the `PDFAValidator.validate(...)` or `GFPDAcroForm(acroForm).getdynamicRender()` APIs to process untrusted PDFs are vulnerable to XXE exploits. Both vulnerable paths share the same root cause: the underlying source binds a default `DocumentBuilderFactory` and immediately calls `newDocumentBuilder()` which does not disable parsing of DTDs, external entities, XInclude, or external resource access directives in XML schemas. This is an XXE vulnerability affecting applications that use veraPDF's affected APIs to parse or validate untrusted PDFs. An attacker could craft a PDF that includes crafted XML external entities that when processed by vulnerable consumers could lead to local file disclosure and server-side outbound requests to attacker-controlled endpoints, depending on JVM XML parser behavior and network controls on the host.
### Summary veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and `GFPDAcroForm.getdynamicRender()`). A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values or XFA configurations, allowing local file disclosure and potentially outbound network requests depending on the runtime (host) environment. ### Details Consumers that utilise either the `PDFAValidator.validate(...)` or `GFPDAcroForm(acroForm).getdynamicRender()` APIs to process untrusted PDFs are vulnerable to XXE exploits. Both vulnerable paths share the same root cause: the underlying source binds a default `DocumentBuilderFactory` and immediately calls `newDocumentBuilder()` which does not disable parsing of DTDs, external entities, XInclude, or external resource access directives in XML schemas. This is an XXE vulnerability affecting applications that use veraPDF's affected APIs to parse or validate untrusted PDFs. An attacker could craft a PDF that includes crafted XML external entities that when processed by vulnerable consumers could lead to local file disclosure and server-side outbound requests to attacker-controlled endpoints, depending on JVM XML parser behavior and network controls on the host.