An improper restriction of recursive entity references in DTDs allows XML External Entity processing and XML entity expansion, which may lead to information disclosure or denial of service. The flaw occurs during parsing of provider responses in Apache JClouds and is identified as CWE-776. The impact can expose sensitive configuration or internal data and overwhelm the application with entity expansions.

Apache JClouds, all versions, is affected. The project is retired and no further updates are expected to address the flaw.

A CVSS score is not published and the EPSS score is unavailable; the vulnerability is not listed in CISA KEV. The likely attack vector is the remote processing of XML provider responses; if an attacker can influence the XML sent to the JClouds client, they may trigger the vulnerability. Because the project is no longer maintained, the risk persists but no official fix will appear. Mitigation relies on limiting exposure or moving to an alternative.