CVE-2019-17554: Apache Olingo

Medium severity, CVSS 5.5. EPSS: 12.2% chance of exploitation in the next 30 days.

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.

Affected products

• Apache Olingo: from 4.0.0, up to and including 4.6.0

Published 2019-12-04. Last modified 2026-06-17.