CVE-2025-41235

What it actually does

The component forwards X-Forwarded-For and Forwarded headers received from untrusted proxies without validation, allowing spoofed client IP and connection metadata to be passed downstream.

Why it matters to the business

Attackers can influence access-control decisions, logging, or rate-limiting based on falsified origin data, increasing risk of unauthorized access or evasion across dependent services; the issue affects multiple long-supported Ubuntu releases of xmltooling with low exploit likelihood indicated by EPSS.

How an attack unfolds

An attacker positions a request through an untrusted proxy or directly crafts headers; the vulnerable xmltooling component accepts and forwards the spoofed X-Forwarded-For or Forwarded values, causing downstream logic to treat the request as originating from a trusted source.

How to fix it

Upgrade xmltooling on Ubuntu 14.04 LTS to 1.5.3-2+deb8u3ubuntu0.1, on Ubuntu 16.04 LTS to 1.5.6-2ubuntu0.3, and on Ubuntu 18.04 LTS to 1.6.4-1ubuntu2.1; apply the fixed package versions and restart affected services.

How to confirm the fix worked

Confirm the installed xmltooling package version matches one of the listed fixed releases for the Ubuntu release in use; test that spoofed X-Forwarded-For and Forwarded headers are stripped or ignored from untrusted sources.

Typical attack path

1. Identify an application path that relies on client IP or forwarded metadata for decisions
2. Send crafted requests containing spoofed X-Forwarded-For or Forwarded headers via untrusted proxy or direct connection
3. Observe or abuse downstream behavior that trusts the forwarded values for access control, logging, or routing

How to detect it

Inspect web server or application logs for entries showing X-Forwarded-For or Forwarded headers originating from unexpected external IPs; correlate with access decisions that appear inconsistent with actual client addresses.

What your security team should do

• Apply the exact fixed xmltooling package versions immediately on all listed Ubuntu releases
• Review any application code that consumes X-Forwarded-For or Forwarded headers and enforce trusted-proxy lists
• Monitor for header-related anomalies until patches are deployed