CVE-2014-0225: Improper Restriction of XML External Entity Reference in Spring Framework
Summary
CVE-2014-0225: Improper Restriction of XML External Entity Reference in Spring Framework. Affects org.springframework:spring-webmvc across 2 version ranges.
>= 3.0.0, < 3.2.8
>= 4.0.0, < 4.0.5
Fixed in 3.2.8 or 4.0.5, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2014-0225 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides a comprehensive programming and configuration model for modern Java-based enterprise applications. The Spring Framework includes various modules, such as spring-webmvc, which is responsible for providing web application support. This module enables developers to build web applications using the Model-View-Controller (MVC) architectural pattern. However, versions 4.0.0 to 4.0.4 and 3.0.0 to 3.2.8 of the Spring Framework, and possibly earlier unsupported versions, are vulnerable to an XML External Entity (XXE) attack.
Vulnerability Detail
The vulnerability arises from the Spring Framework's handling of user-provided XML documents. By default, the affected versions do not disable the resolution of URI references in a Document Type Definition (DTD) declaration. This allows an attacker to exploit the vulnerability by crafting a malicious XML document that includes an external entity reference. When the XML document is processed, the XXE attack can be triggered, potentially leading to unauthorized access to sensitive information, denial of service, or other malicious activities.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.2.83.2.8 -
>= 4.0.0, < 4.0.54.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround is to disable the resolution of URI references in DTD declarations. This can be achieved by configuring the XML parser used by the Spring Framework to disallow external entity references. The specific steps to implement this workaround may vary depending on the XML parser being used. Consult the documentation of the XML parser for guidance on how to disable external entity resolution.
Conclusion
The Spring Framework versions 4.0.0 to 4.0.4 and 3.0.0 to 3.2.8 are vulnerable to an XML External Entity (XXE) attack. This vulnerability can be exploited by crafting malicious XML documents that include external entity references. To mitigate the risk, it is recommended to upgrade to the fixed versions of the Spring Framework or apply the provided workaround. Secure coding practices and input validation should also be followed to prevent XXE attacks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
An XML External Entity (XXE) attack is a type of security vulnerability that occurs when an application processes XML input without disabling the resolution of external entities. By including malicious external entity references in an XML document, an attacker can exploit this vulnerability to read sensitive files, perform remote code execution, or launch denial of service attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes your pom.xml file and provides real-time alerts for open-source vulnerabilities in your software.
The impact of this vulnerability can vary depending on the specific application and its usage of the vulnerable Spring Framework modules. In general, the vulnerability can lead to unauthorized access to sensitive information, denial of service, or other malicious activities.
No, only versions 4.0.0 to 4.0.4 and 3.0.0 to 3.2.8 of the Spring Framework, and possibly earlier unsupported versions, are affected by this vulnerability. It is recommended to check the version of the Spring Framework used in your application and upgrade if necessary.
There are known exploits for XXE vulnerabilities in general, but the specific exploit targeting this vulnerability in the Spring Framework may not be publicly available. However, it is important to address the vulnerability promptly to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
