CVE-2026-19614: NanoXML 2.2.3 XXE Injection Vulnerability

CVE-2026-19614 Overview

CVE-2026-19614 is an XML External Entity (XXE) injection vulnerability in NanoXML version 2.2.3. The library's API enables XML external entity support by default, allowing attackers to submit crafted XML documents that reference external entities. Applications that parse untrusted XML with NanoXML can leak limited information or trigger secondary requests to attacker-controlled resources. This vulnerability is classified under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Applications using NanoXML 2.2.3 to parse attacker-influenced XML input may expose subsystem resources through external entity resolution when the library is used with its default configuration.

Affected Products

NanoXML 2.2.3
Applications and libraries that embed NanoXML 2.2.3 for XML parsing
Downstream products bundling the vulnerable NanoXML API

Discovery Timeline

2026-09-08 - CVE-2026-19614 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-19614

Vulnerability Analysis

NanoXML is a small XML parser historically used by Java applications that require a lightweight XML processing library. The 2.2.3 release enables external entity resolution by default. When an application passes attacker-supplied XML through the NanoXML API, the parser resolves <!ENTITY> declarations that reference external URIs or system files.

The result is a classic XXE condition. An attacker who controls XML input can force the parser to fetch content from local paths or remote URLs, then reflect that content back through the application or exfiltrate it out-of-band. Because external entity support is on by default, developers who did not explicitly harden the parser inherit the weakness.

See the Thales Group advisory for CVE-2026-19614 for vendor-provided detail.

Root Cause

The root cause is insecure default configuration in the NanoXML parser API. External entity processing is enabled without an opt-out enforced at the library layer. Any consumer that parses XML from an untrusted source is exposed unless the application explicitly disables entity resolution before parsing.

Attack Vector

Exploitation is network-based and requires an authenticated user with low privileges to submit XML to a vulnerable endpoint. The attacker crafts an XML document containing an external entity declaration that references a local file, an internal service URL, or an attacker-controlled server. When NanoXML parses the document, the parser resolves the entity and returns or acts on the fetched content.

Because verified proof-of-concept code is not publicly available at this time, defenders should treat any XML endpoint backed by NanoXML 2.2.3 as reachable through standard XXE exploitation techniques described in the OWASP XXE Prevention Cheat Sheet.

Detection Methods for CVE-2026-19614

Indicators of Compromise

Inbound XML payloads containing <!DOCTYPE> declarations with SYSTEM or PUBLIC external references
Outbound DNS or HTTP requests from application servers to unexpected external hosts immediately following XML processing
Application logs showing NanoXML parser activity paired with reads of sensitive local paths such as /etc/passwd or Windows configuration files
Unexpected internal service enumeration originating from application server processes

Detection Strategies

Inspect HTTP request bodies at the web application firewall for <!ENTITY and SYSTEM keywords targeting XML endpoints
Correlate XML parse events with outbound network connections from the same process using EDR telemetry
Perform dependency scanning across build artifacts to identify inclusion of nanoxml-2.2.3.jar or equivalent packages
Add software composition analysis rules that flag NanoXML 2.2.3 in Maven, Gradle, and Ivy manifests

Monitoring Recommendations

Forward XML parser and application error logs to a central data lake for retrospective search on entity resolution errors
Alert on file-read syscalls issued by Java processes shortly after HTTP requests containing XML content types
Baseline outbound network activity from application tiers and alert on new destinations resolved during request processing

How to Mitigate CVE-2026-19614

Immediate Actions Required

Identify all applications that depend on NanoXML 2.2.3 through software bill of materials review
Disable external entity resolution in the NanoXML parser configuration before processing any untrusted input
Restrict outbound network access from application servers that parse XML so that entity resolution cannot reach internal services or the internet
Route XML endpoints through a WAF that strips DOCTYPE declarations from request bodies

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-19614 at publication time. Consult the Thales Group advisory for CVE-2026-19614 for updates. Where a fixed release is unavailable, migrate to an actively maintained XML parser that disables external entities by default, such as a current version of a mainstream Java XML library configured per OWASP guidance.

Workarounds

Wrap NanoXML parser instantiation in application code that rejects XML containing <!DOCTYPE> declarations before the parser sees the payload
Enforce a strict allowlist of XML schemas for each endpoint and reject documents that deviate
Prefer JSON or other non-XML data formats for new integrations that would otherwise depend on NanoXML
Isolate services that must parse untrusted XML into segmented network zones with egress filtering

bash

# Configuration example: block DOCTYPE declarations at the reverse proxy
# NGINX snippet to reject XML bodies containing external entity declarations
location /api/xml {
    if ($request_body ~* "<!DOCTYPE") {
        return 400 "XML DOCTYPE declarations are not permitted";
    }
    proxy_pass http://backend_xml_service;
}