In Eclipse RDF4J, certain XML parser entry points fail to fully block XML External Entity processing when handling untrusted RDF data or query results. This flaw permits DOCTYPE declarations, external entity references, and external DTD loading, which can allow an attacker to read internal files or cause denial‑of‑service by exhausting resources. The vulnerability stems from an incomplete fix of a prior XXE issue, leading to inconsistent parser safeguards across the library.

The issue affects versions of Eclipse RDF4J older than 5.3.2 from the Eclipse Foundation. Any deployment that accepts or imports external XML-based RDF content or process query results with these parser entry points is potentially vulnerable.

The CVSS score of 8.7 reflects a high impact flaw with likely remote exploitation possibilities; the EPSS score is currently unavailable, and the vulnerability is not listed in CISA KEV. An attacker could exploit this by supplying crafted XML to a component that processes RDF data, provoking the parser to resolve external entities. The lack of mitigation in earlier releases means the vulnerability can be triggered without additional credentials, making exploitation a realistic risk.