VYPR
← All advisories
High severityNVD Advisory· Published Jun 16, 2021· Updated Aug 3, 2024

CVE-2021-33813

CVE-2021-33813

Description

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

XXE vulnerability in JDOM's SAXBuilder allows denial of service via crafted HTTP requests up to version 2.0.6.

Vulnerability

JDOM through version 2.0.6 contains an XML External Entity (XXE) vulnerability in the SAXBuilder class. The library fails to properly enforce security features that disable external entities, regardless of the boolean value set for the http://xml.org/sax/features/external-general-entities feature. This allows an attacker to craft an XML payload that, when parsed by SAXBuilder, expands external entities and causes excessive resource consumption. The vulnerability is identified as CVE-2021-33813 [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request containing an XXE payload, such as a billion laughs attack (quadratic or exponential entity expansion), to an application that uses the vulnerable SAXBuilder for XML parsing. No authentication or special privileges are required. The attacker only needs to provide a malicious XML document that triggers entity expansion [2].

Impact

Successful exploitation leads to a denial of service (DoS) condition due to uncontrolled resource consumption (CPU and memory). The vulnerability does not lead to information disclosure or remote code execution; its primary impact is service disruption [1][2].

Mitigation

JDOM version 2.0.6.1 was released on 2021-06-22 and fixes this issue by ensuring user-specified parser features take precedence after entity expansion settings [3]. As a workaround, users can call builder.setExpandEntities(false) to disable entity expansion, which mitigates the vulnerability [2].

References
  1. NVD - CVE-2021-33813
  2. CVE-2021-33813
  3. Release JDOM 2.0.6.1 · hunterhacker/jdom

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jdom:jdom2Maven
< 2.0.6.12.0.6.1
org.jdom:jdomMaven
<= 2.0.2—

Affected products

156

Patches

1
dd4f3c2fc789

Addresses #189 - synchronizes external entity expansion setting

https://github.com/hunterhacker/jdomRolf LearJul 2, 2021via ghsa
commit
1 file changed · +6 −0
  • core/src/java/org/jdom2/input/SAXBuilder.java+6 −0 modified
    @@ -82,6 +82,7 @@ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 import org.jdom2.DocType;
 import org.jdom2.Document;
 import org.jdom2.EntityRef;
+import org.jdom2.JDOMConstants;
 import org.jdom2.JDOMException;
 import org.jdom2.JDOMFactory;
 import org.jdom2.Verifier;
@@ -797,6 +798,11 @@ public void setFastReconfigure(final boolean fastReconfigure) {
 	public void setFeature(final String name, final boolean value) {
 		// Save the specified feature for later.
 		features.put(name, value ? Boolean.TRUE : Boolean.FALSE);
+		if (JDOMConstants.SAX_FEATURE_EXTERNAL_ENT.equals(name)) {
+			// See issue https://github.com/hunterhacker/jdom/issues/189
+			// And PR https://github.com/hunterhacker/jdom/pull/188
+			setExpandEntities(value);
+		}
 		engine = null;
 	}

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

31

News mentions

0

No linked articles in our index yet.