CVE-2009-2625: Apache XERCES2 Java

Medium severity, CVSS 5.0. EPSS: 30.4% chance of exploitation in the next 30 days.

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

Affected products

• Apache XERCES2 Java: version 2.9.1 only
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only; version 9.10 only
• Debian Debian Linux: version 4.0 only; version 5.0 only
• Fedoraproject Fedora: version 10 only; version 11 only
• Opensuse Opensuse: version 11.0 only; version 11.1 only; version 11.2 only
• Oracle JDK: version 1.5.0 only; version 1.6.0 only
• Oracle Primavera p6 Enterprise Project Portfolio Management: version 6.1 only; version 6.2.1 only; version 7.0 only
• Oracle Primavera Web Services: version 6.2.1 only; version 7.0 only
• Suse Linux Enterprise Server: version 9 only; version 10 only; version 11 only

Published 2009-08-06. Last modified 2026-06-16.