Hypera Dragonfly 0.3.0-SNAPSHOT

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:hypera:dragonfly:0.3.0-snapshot:*:*:*:*:*:*:*

part: a version: 0.3.0-snapshot update: *

VendorHypera (bc27ff1f-fea6-5f69-a407-2c8c4e621470)
ProductDragonfly (e9940f26-7038-5e97-b28e-234c06414a0d)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/hyperadev/dragonfly purl2cpe 2026-06-01 10:11:15.247326

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-41967 vulnerable 2026-06-08 05:49:29.006861 Improper Restriction of XML External Entity Reference in Dragonfly
HIGH (7)
Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.
Published: 2022-12-27T23:45:00.786Z
Updated: 2025-04-14T16:23:21.201Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.