Loading story…
Apache disclosed CVE-2013-4517, a denial-of-service vulnerability affecting all released versions of Apache Santuario XML Security for Java. During XML Signature transform processing, the library could process Document Type Definitions (DTDs) even when secure validation was enabled, allowing a remote attacker to trigger an OutOfMemoryError and exhaust application memory. Apache fixed the issue in version 1.5.6 by disabling DTD processing in secure-validation mode and urged users of the 1.4.x and 1.5.x branches to upgrade.
Red Hat issued Moderate-severity updates for JBoss SOA Platform 5.3.1, JBoss Enterprise Web Platform 5.2.0, and JBoss Enterprise Application Platform 5.2.0, supplying updated xml-security packages for affected Red Hat Enterprise Linux deployments. Organizations running these JBoss products should install the applicable errata and restart the JBoss server process to load the remediation.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2014:1728 for JBoss Enterprise Web Platform 5.2.0 on RHEL 5 and 6. The advisory provided updated xml-security packages for CVE-2013-4517 and instructed administrators to restart the JBoss server process after updating.
Red Hat issued Moderate-severity advisory RHSA-2014:1726 for JBoss Enterprise Application Platform 5.2.0 deployments on RHEL 4, 5, and 6. It supplied updated xml-security packages to address the CVE-2013-4517 denial-of-service issue and required a JBoss server restart after installation.
Red Hat issued RHSA-2014:0582, a Moderate-severity advisory, releasing cumulative Rollup Patch 1 for JBoss SOA Platform 5.3.1. The update remediated CVE-2013-4517, which could allow remote memory-exhaustion denial of service through DTD processing in XML transforms.
Apache Santuario XML Security for Java corrected CVE-2013-4517 in version 1.5.6 by preventing DTD processing during XML Signature transforms when secure validation is enabled. The flaw, reported by James Forshaw, affected all released versions and could let an attacker trigger an OutOfMemoryError denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourcegithub.com
Open sourcecoheigea.blogspot.com.au
Open sourcecwiki.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued Important security updates across JBoss Enterprise Application Platform (EAP), Data Grid, A-MQ, SOA Platform, and Fuse to remediate Apache WSS4J and other component vulnerabilities. A key issue, **CVE-2015-0226**, left WS-Security deployments using PKCS#1 v1.5 XML Encryption exposed to a Bleichenbacher adaptive chosen-ciphertext attack: crafted messages could distinguish encrypted-key processing failures from message-data failures and create a decryption oracle. The advisories also addressed XML Signature wrapping, XML external entity expansion, CPU-exhaustion, authentication and authorization weaknesses, and the insecure default permissions of the local `.jboss-cli-history` file. Affected EAP 6.4 systems on RHEL 6 and 7 were instructed to install updated packages, reconcile retained `.rpmnew` configuration files where applicable, and restart JBoss services. Red Hat also directed Data Grid 6.4.0 customers to upgrade to 6.4.1 and A-MQ 6.1.0 users to upgrade to 6.2.0; later SOA Platform and Fuse releases additionally fixed severe JGroups, BeanShell, Groovy, Spring, Camel, Shiro, and Bouncy Castle issues, including remote code execution, cluster-message spoofing, denial of service, information disclosure, and private-key exposure risks.
Aug 29, 2026
Red Hat issued Important-security updates across JBoss BPM Suite, JBoss BRMS, JBoss Fuse Service Works, and JBoss Data Grid, addressing flaws that could lead to remote or authenticated arbitrary Java code execution. Affected components included Xalan-Java XSLT secure-processing bypasses, insecure XStream XML deserialization, Apache Camel XSLT handling, and MVEL/JBoss Rules expression evaluation; several releases also corrected XML external entity (XXE) weaknesses in OpenSAML, Camel, and RESTEasy. The updates additionally fixed Java Security Manager policy failures that could grant deployed applications `java.security.AllPermission`, JBoss MSC service-registry access-control issues, HawtJNI temporary-file risks, plaintext authentication-parameter logging, Smack XMPP spoofing, WebSocket memory-exhaustion denial of service, and TLS CBC padding-oracle exposure. Red Hat instructed customers to back up installations, stop the JBoss Application Server, apply the applicable upgraded release or roll-up patch, and restart services; organizations using rule-authoring or externally exposed environments were advised to retain Java Security Manager sandboxing for MVEL evaluation.
Aug 31, 2026
Red Hat released JBoss Web Server 2.1.0 for Red Hat Enterprise Linux 5 and 6, replacing version 2.0.1 and addressing five Apache HTTP Server and Apache Tomcat vulnerabilities. The update fixes a `mod_status` heap-buffer-overflow issue that could enable remote code execution, denial-of-service flaws in `mod_deflate` and `mod_cgid`, and XML-processing weaknesses including XXE information disclosure. The release also remediates **CVE-2014-0119**, in which a malicious application could, in limited circumstances, hijack XML parsers used by Tomcat/JBoss Web. This could bypass XXE restrictions and expose XML files handled by other applications on the same server instance. Red Hat advised affected users to apply prerequisite errata, back up applications and configurations, upgrade to JBoss Web Server 2.1.0, and restart the JBoss server process.
Aug 29, 2026