Read the docs
TI-2013-03964 Aliases CVE-2013-4517GHSA-4p4w-6h54-g885

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows…

Priority LOW 31CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 20 fixed, 7 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

Why it matters now

EPSS 0.08863 95th percentileScored 2026-11-07
Fix Partial org.apache.santuario:xmlsec (Maven): 1.5.6Red Hat: 14 advisoriesRed Hat: 20 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.santuario:xmlsec (Maven)before 1.5.61.5.6Patch availableGHSA-4p4w-6h54-g885
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.santuario:xmlsec (Maven) Vendor— Affected before 1.5.6 Fixed in 1.5.6 Patch available GHSA-4p4w-6h54-g885

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:apache:santuario_xml_security_for_java:*:*:*:*:*:*:*:*up to 1.5.5VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableApache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:*:*:*:*:*:*:*:* Versions up to 1.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·Apache
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.8:*:*:*:*:*:*:*1.4.8VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableApache
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.4:*:*:*:*:*:*:*1.5.4VulnerableApache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.8:*:*:*:*:*:*:* Versions 1.4.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.4:*:*:*:*:*:*:* Versions 1.5.4 Vulnerable ·Apache

Remediation

  • Fix · GHSA-4p4w-6h54-g885 org.apache.santuario:xmlsec (Maven) Fixed in 1.5.6 Advisory →

Red Hat 14 advisories

  • RHSA-2015:0850 Released 2015-04-16 · Red Hat rating Important
    Red Hat JBoss BRMS 6.1.0 update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2015:0851 Released 2015-04-16 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.1.0 update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2015:0675 Released 2015-03-11 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.1.0 update
    • Red Hat JBoss Data Virtualization 6.1
Show 11 more Red Hat advisories
  • RHSA-2014:1726 Released 2014-10-28 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS xml-security-1.5.6-3.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES xml-security-1.5.6-3.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server xml-security-1.5.6-3.ep5.el5
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server xml-security-1.5.6-3.el6
  • RHSA-2014:1727 Released 2014-10-28 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Web Platform 5.2.0 security update
    • Red Hat JBoss Web Platform 5.2
  • RHSA-2014:1728 Released 2014-10-28 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Web Platform 5.2.0 security update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server xml-security-1.5.6-3.ep5.el5
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server xml-security-1.5.6-3.el6
  • RHSA-2014:1725 Released 2014-10-28 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5.2
  • RHSA-2014:0582 Released 2014-05-29 · Red Hat rating Moderate
    Red Hat JBoss SOA Platform 5.3.1 update
    • Red Hat JBoss SOA Platform 5.3
  • RHSA-2014:0473 Released 2014-05-06 · Red Hat rating Moderate
    Red Hat JBoss Operations Network 3.2.1 update
    • Red Hat JBoss Operations Network 3.2
  • RHSA-2014:0400 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss Fuse 6.1.0 update
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:0195 Released 2014-02-20 · Red Hat rating Moderate
    Red Hat JBoss Portal 6.1.1 update
    • Red Hat JBoss Portal Platform 6.1
  • RHSA-2014:0170 Released 2014-02-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.1 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server hornetq-2.3.14-1.Final_redhat_1.1.ep6.el5, jacorb-jboss-2.3.2-13.redhat_6.1.ep6.el5, jboss-as-appclient-7.3.1-3.Final_redhat_3.1.ep6.el5 +47
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server jbossas-javadocs-7.3.1-3.Final_redhat_3.ep6.el5
  • RHSA-2014:0171 Released 2014-02-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.1 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server hornetq-2.3.14-1.Final_redhat_1.1.ep6.el6, jacorb-jboss-2.3.2-13.redhat_6.1.ep6.el6, jboss-as-appclient-7.3.1-3.Final_redhat_3.1.ep6.el6 +47
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server jbossas-javadocs-7.3.1-3.Final_redhat_3.ep6.el6
  • RHSA-2014:0172 Released 2014-02-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.1 update
    • Red Hat JBoss Enterprise Application Platform 6.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix planned: Will not fix
Red Hat JBoss Data Virtualization 6AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 4AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix yet
Red Hat JBoss Operations Network 3AffectedNo fix yet
Red Hat JBoss Portal 4AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 4AffectedNo fix planned: Will not fix
Red Hat JBoss BPMS 6.0Fixed RHSA-2015:0851
Red Hat JBoss BRMS 6.0Fixed RHSA-2015:0850
Red Hat JBoss Data Virtualization 6.1Fixed RHSA-2015:0675
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASFixed RHSA-2014:1726
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESFixed RHSA-2014:1726
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2014:1726
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2014:1726
Red Hat JBoss Enterprise Application Platform 5.2Fixed RHSA-2014:1725
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 ServerFixed RHSA-2014:0170
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 ServerFixed RHSA-2014:0171
Red Hat JBoss Enterprise Application Platform 6.2Fixed RHSA-2014:0172
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 ServerFixed RHSA-2014:0170
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 ServerFixed RHSA-2014:0171
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0400
Red Hat JBoss Operations Network 3.2Fixed RHSA-2014:0473
Red Hat JBoss Portal Platform 6.1Fixed RHSA-2014:0195
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2014:0582
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2014:1728
Red Hat JBoss Web Platform 5 for RHEL 6 ServerFixed RHSA-2014:1728
Red Hat JBoss Web Platform 5.2Fixed RHSA-2014:1727
Not affected: 3 products
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS
  • Red Hat JBoss Web Platform 5 for RHEL 4 ES

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4517
  2. 2026-10-03 Alias added: GHSA-4p4w-6h54-g885

References

Advisory 13

Other 9

  • TI-2021-17647 Bypass of the secureValidation property CVSS 3.1HIGH 7.5
  • TI-2023-23977 Apache Santuario: Private Key disclosure in debug-log output CVSS 3.1MEDIUM 6.5
  • TI-2014-06767 Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to… CVSS 2.0MEDIUM 5.0
  • TI-2013-01939 jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security… CVSS 2.0MEDIUM 4.3
  • TI-2019-09247 Improper input validation in Apache Santuario - XML Security for Java CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences