CVE-2019-12400: Apache Santuario XML Security For Java

Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days.

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

Affected products

• Apache Santuario XML Security For Java: from 2.0.3, up to and including 2.0.10; from 2.1.0, before 2.1.4 (fixed in 2.1.4)
• Oracle WebLogic Server: version 12.2.1.4.0 only; version 14.1.1.0.0 only
• Red Hat JBoss Enterprise Application Platform: version 7.2 only

Published 2019-08-23. Last modified 2026-06-17.