Hi,

The following vulnerability was published for rdf4j.

CVE-2018-1000644[0]:
| Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External
| Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files
| that can result in the disclosure of confidential data, denial of
| service, server side request forgery, port scanning. This attack
| appear to be exploitable via Specially crafted RDF file.

Please note that the issue recently got a second CVE assigned,
CVE-2026-15803 for an incomplete fix of the original CVE-2018-1000644.
So once fixing this issue, make sure to fix it completely following
[3].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-1000644
https://www.cve.org/CVERecord?id=CVE-2018-1000644
[1] https://github.com/eclipse-rdf4j/rdf4j/issues/1056
[2] https://github.com/eclipse-rdf4j/rdf4j/commit/50f2f51950227a4ec595a2922d81da487aba5135
[3] https://gitlab.eclipse.org/security/cve-assignment/-/work_items/175

Regards,
Salvatore

Yours,

Bohdan Artiushenko

We believe that the bug you reported is fixed in the latest version of
rdf4j, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144952@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated rdf4j package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 17 Oct 2026 21:25:33 +0200
Source: rdf4j
Architecture: source
Version: 5.3.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1144952 1149474
Changes:
 rdf4j (5.3.2-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release
     - Fixes CVE-2018-1000644 and CVE-2026-15803 (Closes: #1144952)
     - Refreshed the patches
     - Updated the list of modules
     - Map jakarta.xml.bind-api to jaxb-api
     - Raised the source/target level to Java 11
     - Build the rdf4j-sail-api module
     - Removed the dependency on hasmac-json-ld
     - Ignore the spotless Maven plugin
   * Fixed the build failure with logback 1.6 (Closes: #1149474)
   * Converted debian/watch to the version 5 format
   * Standards-Version updated to 4.7.4
   * Removed the Priority field
   * Excluded the .orig files from the upstream tarball
Checksums-Sha1:
 a56361019919f22f79b82489318046be4a874ecd 2491 rdf4j_5.3.2-1.dsc
 904332d184b6beb55f106c386bfe46cf851c2d31 28329628 rdf4j_5.3.2.orig.tar.xz
 1766c061852b2ace33499cba64d4938227cb3902 13740 rdf4j_5.3.2-1.debian.tar.xz
 c01b2754fb17c9da3f761ea4bf520876511e9dcb 14986 rdf4j_5.3.2-1_source.buildinfo
Checksums-Sha256:
 105ebdbebbbea59c2654ba912bd2c9f5ad8ebbf3f4c523559bf0b15f626b94cd 2491 rdf4j_5.3.2-1.dsc
 dfff5f4dc5b4faa9ee9cc219de3ed4af8b6fdf0ca343ef33ea37e3f1ca8d4892 28329628 rdf4j_5.3.2.orig.tar.xz
 c1ec02eb177c6ce025247b3f84f7f6a7ea397b6c176c4919d3c3be9dab522798 13740 rdf4j_5.3.2-1.debian.tar.xz
 439b04e8a690f2472abed37f9b52db503abdb3e2df736debe64cf723c8a20aa7 14986 rdf4j_5.3.2-1_source.buildinfo
Files:
 13f0cb11222dc1619ef25d18effc755f 2491 java optional rdf4j_5.3.2-1.dsc
 98f519a34e2761e638b829f028167305 28329628 java optional rdf4j_5.3.2.orig.tar.xz
 c0fb69f63ddcffdd6bd8fc9e93bcb159 13740 java optional rdf4j_5.3.2-1.debian.tar.xz
 444d019a9dcd478a4dd0ca63a5fd96a6 14986 java optional rdf4j_5.3.2-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrUA2cSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsI9IP/24+jer0e2KlOPX7gNE0lA9tZaFYJnkA
aJETP++Mia8qlrLU+jB1lLNkwZVGOCg6z394ZzTJtk9ao2crifxZOf9LP5nNIvsX
hZe0WEAvyr8k6fSUM9hXTCp47Z4X72vb3RNW2M5h4Hn44p8RLX3qbfzkBnRyd57h
i0ZmNXBUjfUyPggRHYvjt8nc7s/0+X84UnQbSl/o450ga0u93L5hdsrwz/DAcMjc
i/YT1dQAKPUuc7YZPfjeLfQqsQ228Ai/im6gevePSjohSpqrdWppHwfP7Z15JUsl
YTguvGfODdYV4xvOszHaJXTKaNLsejRea0cLxKdb2/fCsQR6YyFdNwXbOZpC+c2b
aRRcsR4Nv2vHB6mlB+jTnAyWNUFkoFucXe0BOSjnUdW4Ya/U23DpnNZbBIo5evE3
xvFF43lbx+jh5ILphs7WxB8W959OOuRXzOffiFM04ahvHvfWAhWybN/MDbMIV4U7
4y5kR9Owv++LywXaRnFS+wXAICdtlUzGS4R7ywa9eHIUQiNMqTUYAfYXoBcqae93
rKGRY8dWYnNgemB5/3+uvfwh0RHDjy7O0IuK7YuOJuWipQ71ideaDvNKGrIbZe5V
9yabx7UAAQlU8dH5L0RQH1PeCdk3MTL35Lsnjnt3sr0BZaCvKeQzb6WiyODjf3IP
xQCA76F7O9s7
=9ChS
-----END PGP SIGNATURE-----