CVE-2009-1885: Apache Xerces-C++

Medium severity, CVSS 4.3. EPSS: 5.3% chance of exploitation in the next 30 days.

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.

Affected products

• Apache Xerces-C++: version 2.7.0 only; version 2.8.0 only

Published 2009-08-11. Last modified 2026-06-16.