Loading vulnerability…
Apache Santuario XML Security for Java XML Signature DoS
CVE-2013-4517 is an uncontrolled memory-consumption vulnerability in Apache Santuario XML Security for Java. Versions through 1.5.5 permit Document Type Definitions (DTDs) to be processed while applying XML Signature Transforms, including when secure validation is enabled. A crafted XML signature can cause excessive memory allocation and trigger an OutOfMemoryError.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can exhaust the memory available to the affected Java process, causing a denial of service. Secure validation does not prevent exploitation in affected versions when the application processes attacker-controlled XML Signature Transform input.
If you can’t patch tonight, do this now.
No reliable configuration-only mitigation is available for affected versions because DTD processing remains enabled during Transform application even with secure validation enabled. As a compensating control, prevent untrusted XML Signature inputs containing DTDs from reaching vulnerable Transform processing until the library or affected product can be upgraded.
Patch, then assume compromise.
Upgrade Apache Santuario XML Security for Java xmlsec to version 1.5.6 or later. The fixed release prevents DTD processing during Transform application when secure validation is enabled. Apply the corresponding vendor update for products that bundle the vulnerable library, then restart affected application-server processes where required.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.