Description
Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml-security-java | 1.5.6-1 | — |
| Debian 13 | libxml-security-java | 1.5.6-1 | — |
| Debian 12 | libxml-security-java | 1.5.6-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | xml-security | 1.5.6-3.el6 | RHSA-2014:1728 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.14-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jacorb-jboss | 2.3.2-13.redhat_6.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-cli +6 | 7.3.1-4.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-cmp +25 | 7.3.1-2.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-ee +19 | 7.3.1-3.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.5.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-xnio-base | 3.0.9-1.GA_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-core | 7.3.1-5.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.3.1-3.Final_redhat_3.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.3.1-6.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossweb | 7.3.0-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | netty | 3.6.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-2.SP3_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.17-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.6-1.redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | xmltooling | 1.3.4-5.redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 5 | xml-security | 1.5.6-3.el6 | RHSA-2014:1726 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.santuario:xmlsec | < 1.5.6 | 1.5.6 | GHSA-4p4w-6h54-g885 |
Advisories 6
- RHSA-2014:1728 Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:1726 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0170 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0171 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
References
- RHSA-2014:1728 vendor-advisory
- RHSA-2014:1726 vendor-advisory
- RHSA-2014:0170 vendor-advisory
- RHSA-2015:0675 vendor-advisory
- 101169 vdb-entry
- RHSA-2015:0850 vendor-advisory
- RHSA-2014:0195 vendor-advisory
- https://www.tenable.com/security/tns-2018-15
- santuario-xmlsecurity-cve20134517-dos(89891) vdb-entry
- RHSA-2014:1727 vendor-advisory
- RHSA-2015:0851 vendor-advisory
- 20131218 Apache Santuario security advisory CVE-2013-4517 released mailing-list
- 1029524 vdb-entry
- RHSA-2014:0172 vendor-advisory
- http://santuario.apache.org/secadv.data/cve-2013-4517.txt.asc
- RHSA-2014:0171 vendor-advisory
- http://packetstormsecurity.com/files/124554/Java-XML-Signature-Denial-Of-Service-Attack.html
- 64437 vdb-entry
- RHSA-2014:1725 vendor-advisory
- 55639 third-party-advisory
- [santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html mailing-list
- [santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html mailing-list