Denial of Service Vulnerability in Apache Xerces2 Java Parser
Summary
CVE-2012-0881: Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions. Affects libxerces2-java versions 2.12.1-1 – 2.12.2-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Xerces2 Java Parser is a library used for parsing, validating, and manipulating XML documents. It is widely used in Java applications for handling XML data. The vulnerability identified as CVE-2012-0881 allows remote attackers to cause a denial of service (CPU consumption) by sending a crafted message to an XML service, triggering hash table collisions.
Vulnerability Detail
The vulnerability in Apache Xerces2 Java Parser arises from the way it handles hash table collisions. By sending a specially crafted message to an XML service, an attacker can cause excessive CPU consumption, leading to a denial of service. This vulnerability can be exploited remotely, without requiring any authentication or user interaction. The impact of this vulnerability is limited to resource exhaustion and disruption of service availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the official patch or upgrade to a fixed version of the Apache Xerces2 Java Parser library.
Conclusion
The vulnerability in Apache Xerces2 Java Parser allows remote attackers to cause a denial of service by triggering hash table collisions. To mitigate this vulnerability, it is crucial to upgrade to Apache Xerces2 Java Parser version 2.12.0 or later. Vulert's playground can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for libxerces2-java →
FAQ
The vulnerability allows remote attackers to cause a denial of service by consuming excessive CPU resources, leading to service disruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, authentication is not required. The vulnerability can be exploited remotely without any authentication or user interaction.
No, there are no known workarounds for this vulnerability. It is necessary to apply the official patch or upgrade to a fixed version of the Apache Xerces2 Java Parser library.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libxerces2-java.
