CVE-2021-39239: Apache Jena

High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days.

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.

Affected products

• Apache Jena: up to and including 4.1.0

Published 2021-09-16. Last modified 2026-06-17.