CVE-2018-1000644

CRITICAL

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of ...

Affects 1 product across 1 vendor.

CVSS 3.010.0
EPSS1.7%
Percentile77th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-611: CWE-611
Related Attack Patterns (CAPEC)
CAPEC-221 Data Serialization External Entities Blowup
via CWE-611

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A critical vulnerability affects Eclipse systems (CVE-2018-1000644). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-123186-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-1000644?
This vulnerability was disclosed in 2018. A critical vulnerability affects Eclipse systems (CVE-2018-1000644). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-1000644?
CVE-2018-1000644 has CVSS 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 1.7%.
Is CVE-2018-1000644 actively exploited?
No confirmed active exploitation of CVE-2018-1000644 as of 2026-05-30.
How do I remediate CVE-2018-1000644?
Priority: MEDIUM.
What systems are affected by CVE-2018-1000644?
CVE-2018-1000644 affects Eclipse Rdf4J.
Vulnerability Details
CVE IDCVE-2018-1000644
BSIDBS-2018-GLOBAL-123186-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2018-08-20
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
CWE-611
SourceNVD
Official Description

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Eclipse Rdf4J 2.4.0 < 2.4.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2978 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashc53450cf93caa410aed77e3f48cfde83d3f747c4c1c8f680f9ef2e70377a59345320c93e05d63ec06e42f841a513a353694b459a42c08e3e9df6ab6fee1edc59
Related CVEs affecting Eclipse
CVE-2025-67109 10.0 Improper verification of the time certificate in Eclipse Cyclone DDS before v... CVE-2026-7411 10.0 In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadeq... CVE-2021-32834 9.9 Eclipse Keti is a service that was designed to protect RESTfuls API using Att... CVE-2021-32835 9.9 Eclipse Keti is a service that was designed to protect RESTfuls API using Att... CVE-2017-7657 9.8 In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9...
View all Eclipse CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →