CVE-2013-4002 — xercesImpl
Fix: apache/xerces2-j@266e837CVE-2013-4002 is a security vulnerability in xerces:xercesImpl. EPSS puts its 30-day exploitation probability at 24.7% (98th percentile). A fix is available for xerces:xercesImpl — see the affected versions and patch details below.
Missing XML Validation in Apache Xerces2
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
xerces:xercesImplReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | xerces:xercesImpl | all versions | 2.12.0xerces:xercesImpl:2.12.0 |
Affected Products
xerces2 javaapacheubuntu linuxcanonicalhost on-demandibmjavaibmsterling b2b integratoribmsterling file gatewayibmDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for xerces:xercesImpl, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update xerces:xercesImpl to 2.12.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2013-4002 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle:…
| Product | Fixed in | Advisory |
|---|---|---|
| Oracle Java for Red Hat Enterprise Linux 5 | java-1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
| Red Hat Enterprise Linux 5 | java-1.7.0-openjdk-1:1.7.0.45-2.4.3.1.el5_10 | RHSA-2013:1447 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-1:1.6.0.0-1.42.1.11.14.el5_10 | RHSA-2013:1505 |
| Red Hat Enterprise Linux 6 | java-1.7.0-openjdk-1:1.7.0.45-2.4.3.2.el6_4 | RHSA-2013:1451 |
| Red Hat Enterprise Linux 6 | xerces-j2-0:2.7.1-12.7.el6_5 | RHSA-2014:1319 |
| Red Hat JBoss BPMS 6.0 | xerces-j2 | RHSA-2015:0234 |
| Red Hat JBoss BRMS 6.0 | xerces-j2 | RHSA-2015:0235 |
| Red Hat JBoss Data Grid 6.4 | xerces-j2 | RHSA-2015:0773 |
Frequently Asked Questions
Is CVE-2013-4002 in your dependencies?
Find it across Maven, including transitive dependencies.