Improper Input Validation in Apache Santuario XML Security

MEDIUM 4.3CVE-2013-4517 · GHSA-4p4w-6h54-g885 · Published 11/01/2014 · updated 16/06/2026

In short

CVE-2013-4517 is a MEDIUM (CVSS 4.3) vulnerability affecting org.apache.santuario:xmlsec, santuario xml security for java (apache).
Chance of exploitation in the next 30 days (EPSS): 8.9%, higher than 95.2% of all vulnerabilities.
Fix: update to 1.5.6 or later.

Package	Affected versions	Patched versions
org.apache.santuario:xmlsec Maven	`< 1.5.6`	`1.5.6`
santuario xml security for java apache	`= 1.2.0= 1.2.1= 1.3.0= 1.4.0= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.4.5= 1.4.6= 1.4.7= 1.4.8= 1.5.0= 1.5.1= 1.5.2= 1.5.3= 1.5.4≤ 1.5.5`	No fix yet

Description

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

NVD description

References

More vulnerabilities in org.apache.santuario:xmlsec

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free