The following vulnerability was published for jgit.
CVE-2025-4949[0]:
| In Eclipse JGit versions 7.2.0.202503040940-r and older, the
| ManifestParser class used by the repo command and the AmazonS3 class
| used to implement the experimental amazons3 git transport protocol
| allowing to store git pack files in an Amazon S3 bucket, are
| vulnerable to XML External Entity (XXE) attacks when parsing XML
| files. This vulnerability can lead to information disclosure, denial
| of service, and other security issues.