Critical severity9.8NVD Advisory· Published Sep 28, 2017· Updated Jun 17, 2026
CVE-2017-12621
CVE-2017-12621
Description
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
commons-jelly:commons-jellyMaven | < 1.0.1 | 1.0.1 |
Affected products
3- Range: 1.0
Patches
Vulnerability mechanics
References
9- issues.apache.org/jira/browse/JELLY-293nvdIssue TrackingPatchVendor AdvisoryWEB
- www.securityfocus.com/bid/101052nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1039444nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-6g33-82gc-3pw5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-12621ghsaADVISORY
- lists.apache.org/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73@%3Cdev.commons.apache.org%3EghsaWEB
- web.archive.org/web/20200227144849/http://www.securityfocus.com/bid/101052ghsaWEB
- web.archive.org/web/20210303081618/http://www.securitytracker.com/id/1039444ghsaWEB
- lists.apache.org/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73%40%3Cdev.commons.apache.org%3Envd
News mentions
0No linked articles in our index yet.