VYPR
← All advisories
Medium severity5.3OSV Advisory· Published Sep 17, 2020· Updated Jun 17, 2026

CVE-2020-14338

CVE-2020-14338

Description

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
xerces:xercesImplMaven
< 2.12.0.sp32.12.0.sp3

Affected products

6
  • JBoss/XercesOSV
    Range: jboss-2.11.0.SP6, jboss-2.12.0.SP01, jboss-2.12.0.SP02
  • Red Hat/Xerces3 versions
    cpe:2.3:a:redhat:xerces:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:redhat:xerces:*:*:*:*:*:*:*:*range: <2.12.0
    • cpe:2.3:a:redhat:xerces:2.12.0:sp1:*:*:*:*:*:*
    • cpe:2.3:a:redhat:xerces:2.12.0:sp2:*:*:*:*:*:*
  • osv-coords2 versions
    pkg:apk/chainguard/hadoop-fips-3.3.6pkg:maven/xerces/xercesImpl
    < 3.3.6-r15+ 1 more
    • (no CPE)range: < 3.3.6-r15
    • (no CPE)range: < 2.12.0.sp3

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.