VULNERABILITY INTELLIGENCE
CVE-2009-2625
CVSS score5 MEDIUM
EPSS probability30.38%
CISA KEVNot currently listed
Published2009-08-06
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:N/I:N/A:P
Description
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
Primary references
- cret@cert.org — Mailing List, Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Mailing List, Third Party Advisory
- cret@cert.org — Broken Link
- cret@cert.org — Broken Link
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory