CVE-2021-41411: Red Hat Drools

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Affected products

• Red Hat Drools: before 7.6.0 (fixed in 7.6.0)

Published 2022-06-16. Last modified 2026-06-17.