Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of…
Priority MEDIUM 50CWE-399Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.
Summary
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Why it matters now
EPSS 0.17461 97th percentileScored 2026-11-07
Fix Partial xerces:xercesImpl (Maven): 2.12.0Red Hat: 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | xerces:xercesImpl (Maven) | before 2.12.0 | 2.12.0 | Patch available | GHSA-vmqm-g3vh-847m |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- xerces:xercesImpl (Maven) Vendor— Affected before 2.12.0 Fixed in 2.12.0 Patch available GHSA-vmqm-g3vh-847m
Remediation
- Fix · GHSA-vmqm-g3vh-847m xerces:xercesImpl (Maven) Fixed in 2.12.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 1 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2012-0881
- 2026-10-03 Alias added: GHSA-vmqm-g3vh-847m
References
Other 19
- [j-users] 20180503 [ANNOUNCEMENT]: Apache Xerces-J 2.12.0 now available
- [oss-security] 20140708 Summer bug cleaning - some Hash DoS stuff
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1
- https://bugzilla.redhat.com/show_bug.cgi?id=787104
- https://www.oracle.com//security-alerts/cpujul2021.html
- [hadoop-common-issues] 20210928 [GitHub] [hadoop] warrenzhu25 opened a new pull request #3496: HADOOP-17941. Update xerces to 2.12
- https://github.com/apache/xerces2-j/commit/992b5d9c24102ad20330d36c0a71162753a37449
- https://www.openwall.com/lists/oss-security/2014/07/08/11
- https://lists.apache.org/thread.html/rea7b831dceeb2a2fa817be6f63b08722042e3647fb2d47c144370a56@%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73@%3Cj-users.xerces.apache.org%3E
More Apache Xerces2 Java vulnerabilities
- TI-2013-03496 XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime… CVSS 2.0HIGH 7.1
- TI-2009-02509 XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2012-0881 · CVE Program
- CVE-2012-0881 · NVD
- FIRST EPSS
- GHSA-vmqm-g3vh-847m · GitHub Advisory Database · CC BY 4.0
- CVE-2012-0881 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences