CVE-2018-12544

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.

• CWE-611
• CWE-611

• https://access.redhat.com/errata/RHSA-2018:2946Third Party Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568Issue Tracking, Patch, Vendor Advisory
• https://github.com/vert-x3/vertx-web/issues/1021Patch, Third Party Advisory
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
• https://access.redhat.com/errata/RHSA-2018:2946Third Party Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568Issue Tracking, Patch, Vendor Advisory
• https://github.com/vert-x3/vertx-web/issues/1021Patch, Third Party Advisory
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E

Published

Oct 10, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12539In Eclipse OpenJ9 version 0.8, users other than the process …
• CVE-2018-1254RSA Authentication Manager Security Console, versions 8.3 P1…
• CVE-2018-12540In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHa…
• CVE-2018-12541In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSoc…6.5
• CVE-2018-12542In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the Static…
• CVE-2018-12543In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a m…
• CVE-2018-12545In Eclipse Jetty version 9.3.x and 9.4.x, the server is vuln…7.5
• CVE-2018-12546In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a…6.5
• CVE-2018-12547In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snpr…
• CVE-2018-12548In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the publi…
• CVE-2018-12549In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler ma…
• CVE-2018-1255RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 …6.1