Improper input validation in Apache Santuario - XML Security for Java
Priority LOW 26CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 7 fixed, 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
Why it matters now
EPSS 0.00776 56th percentileScored 2026-11-07
Fix Partial org.apache.santuario:xmlsec (Maven): 2.1.4Red Hat: 7 advisoriesRed Hat: 7 fixed, 9 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Santuario - XML Security for Java | All 2.0.x releases from 2.0.3; all 2.1.x releases before 2.1.4. | — | No fix listed | CNA |
| — | org.apache.santuario:xmlsec (Maven) | 2.0.3 to before 2.1.4 | 2.1.4 | Patch available | GHSA-4q98-wr72-h35w |
- Apache Santuario - XML Security for Java VendorApache Affected All 2.0.x releases from 2.0.3; all 2.1.x releases before 2.1.4. Fixed in — No fix listed CNA
- org.apache.santuario:xmlsec (Maven) Vendor— Affected 2.0.3 to before 2.1.4 Fixed in 2.1.4 Patch available GHSA-4q98-wr72-h35w
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:santuario_xml_security_for_java:*:*:*:*:*:*:*:* | 2.0.3 – 2.0.10; 2.1.0 to before 2.1.4 | Vulnerable | Apache |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* | 14.1.1.0.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:santuario_xml_security_for_java:*:*:*:*:*:*:*:* Versions 2.0.3 – 2.0.10; 2.1.0 to before 2.1.4 Vulnerable ·Apache
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-4q98-wr72-h35w org.apache.santuario:xmlsec (Maven) Fixed in 2.1.4 Advisory →
Red Hat 7 advisories
- RHSA-2020:3192 Released 2020-07-28 · Red Hat rating ImportantRed Hat Fuse 7.7.0 release and security update
- Red Hat Fuse 7.7.0
- RHSA-2020:2067 Released 2020-05-18 · Red Hat rating ImportantRed Hat build of Thorntail 2.5.1 security and bug fix update
- Text-Only RHOAR
- RHSA-2020:0951 Released 2020-03-23 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.7 security update
- Red Hat Single Sign-On 7.3
Show 4 more Red Hat advisories
- RHSA-2020:0805 Released 2020-03-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el7eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el7eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el7eap +47
- RHSA-2020:0804 Released 2020-03-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el6eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el6eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el6eap +47
- RHSA-2020:0806 Released 2020-03-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el8eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el8eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el8eap +47
- RHSA-2020:0811 Released 2020-03-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.7 security update
- Red Hat JBoss EAP 7.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat Fuse 7.7.0 | Fixed | RHSA-2020:3192 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2020:0811 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2020:0804 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2020:0805 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2020:0806 |
| Red Hat Single Sign-On 7.3 | Fixed | RHSA-2020:0951 |
| Text-Only RHOAR | Fixed | RHSA-2020:2067 |
Not affected: 2 products
- Red Hat Decision Manager 7
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12400
- 2026-10-03 Alias added: GHSA-4q98-wr72-h35w
References
Advisory 7
Other 15
- [santuario-dev] 20190905 Re: [CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source
- [santuario-dev] 20190906 Re: [CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source
- [tomee-commits] 20200324 [jira] [Created] (TOMEE-2791) TomEE plus(7.0.7) is affected by CVE-2019-12400 vulnerability
- [tomee-commits] 20200720 [jira] [Created] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400
- [tomee-commits] 20200720 [jira] [Assigned] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400
- [tomee-commits] 20200720 [jira] [Commented] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400
- [santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html
- https://lists.apache.org/thread.html/8e814b925bf580bc527d96ff51e72ffe5bdeaa4b8bf5b89498cab24c@%3Cdev.santuario.apache.org%3E
- https://lists.apache.org/thread.html/edaa7edb9c58e5f5bd0c950f2b6232b62b15f5c44ad803e8728308ce@%3Cdev.santuario.apache.org%3E
- https://lists.apache.org/thread.html/r107bffb06a5e27457fe9af7dfe3a233d0d36c6c2f5122f117eb7f626@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd@%3Ccommits.santuario.apache.org%3E
- https://lists.apache.org/thread.html/rcdc0da94fe21b26493eae47ca987a290bdf90c721a7a42491fdd41d4@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/rf82be0a7c98cd3545e20817bb96ed05551ea0020acbaf9a469fef402@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/rf958cea96236de8829940109ae07e870aa3d59235345421e4924ff03@%3Ccommits.tomee.apache.org%3E
- https://security.netapp.com/advisory/ntap-20190910-0003
More Apache Santuario Xml Security For Java vulnerabilities
- TI-2021-17647 Bypass of the secureValidation property CVSS 3.1HIGH 7.5
- TI-2023-23977 Apache Santuario: Private Key disclosure in debug-log output CVSS 3.1MEDIUM 6.5
- TI-2014-06767 Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to… CVSS 2.0MEDIUM 5.0
- TI-2013-03964 Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows… CVSS 2.0MEDIUM 4.3
- TI-2013-01939 jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2019-12400 · CVE Program
- CVE-2019-12400 · NVD
- FIRST EPSS
- GHSA-4q98-wr72-h35w · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12400 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences