CVE-2009-2625 json
Denial of service in Apache Xerces2
published 2009-08-06 17 y ago modified 2026-06-16 4 mo ago also GHSA-334p-wv2m-w3vp , EUVD-2020-0452
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 30.4%
- EPSS 30.4% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
Patch / fix
- maven xerces:xercesImpl 2.10.0
- libxerces2-java Debian 14, Debian 13, Debian 12 2.9.1-4.1
debian advisories DEBIAN-CVE-2009-2625
- jasperreports-server-pro rhev manager 3 4.7.1-2.el6ev
- xerces-j2 RHEL 6 2.7.1-12.6.el6_0
- xerces-j2-demo RHEL 6 2.7.1-12.6.el6_0
- xerces-j2-scripts RHEL 6 2.7.1-12.6.el6_0
- xerces-j2-javadoc-xni RHEL 6 2.7.1-12.6.el6_0
- xerces-j2-javadoc-apis RHEL 6 2.7.1-12.6.el6_0
- xerces-j2-javadoc-impl RHEL 6 2.7.1-12.6.el6_0
- xerces-j2-javadoc-other RHEL 6 2.7.1-12.6.el6_0
red hat advisories RHSA-2012:1537RHSA-2011:0858RHSA-2010:0043RHSA-2009:1662RHSA-2009:1650RHSA-2009:1649
- expat openSUSE Tumbleweed 2.2.0-3.1
opensuse advisories openSUSE-SU-2024:10077-1
- github.com/apache/xerces2-j@0bdf77a commit
- sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 patch
- sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1 advisory
- openwall.com/lists/oss-security/2009/10/22/9 advisory
- svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLSca… advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2009-2625 updated cvss 5.0
JDK: XML parsing Denial-Of-Service (6845701)
-
Red Hat Desktop version 3 Extras java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-src 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-demo 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-jdbc 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-plugin 1.4.2.13.1-1jpp.1.el3 Red Hat Desktop version 4 Extras java-1.6.0-ibm 1.6.0.6-1jpp.3.el4, java-1.5.0-ibm 1.5.0.10-1jpp.4.el4, java-1.5.0-sun 1.5.0.20-1jpp.1.el4, java-1.6.0-sun 1.6.0.15-1jpp.1.el4, java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.6-1jpp.3.el4, +22 morefixed: vendor fix RHSA-2009:1505
-
Red Hat Enterprise Linux (v. 5 server) xerces-j2 2.7.1-7jpp.2.el5_4.2, xerces-j2-demo 2.7.1-7jpp.2.el5_4.2, java-1.6.0-openjdk 1.6.0.0-1.2.b09.el5, xerces-j2-scripts 2.7.1-7jpp.2.el5_4.2, java-1.6.0-openjdk-src 1.6.0.0-1.2.b09.el5, xerces-j2-javadoc-xni 2.7.1-7jpp.2.el5_4.2, +5 morefixed: vendor fix RHSA-2009:1615
-
Red Hat Enterprise Linux AS version 3 Extras java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-src 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-demo 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-jdbc 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-plugin 1.4.2.13.1-1jpp.1.el3 Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm 1.6.0.6-1jpp.3.el4, java-1.5.0-ibm 1.5.0.10-1jpp.4.el4, java-1.5.0-sun 1.5.0.20-1jpp.1.el4, java-1.6.0-sun 1.6.0.15-1jpp.1.el4, java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.6-1jpp.3.el4, +22 morefixed: vendor fix RHSA-2009:1505
-
Red Hat Enterprise Linux Desktop (v. 5 client) xerces-j2 2.7.1-7jpp.2.el5_4.2, java-1.6.0-openjdk 1.6.0.0-1.2.b09.el5, xerces-j2-scripts 2.7.1-7jpp.2.el5_4.2, java-1.6.0-openjdk-src 1.6.0.0-1.2.b09.el5, java-1.6.0-openjdk-demo 1.6.0.0-1.2.b09.el5, java-1.6.0-openjdk-javadoc 1.6.0.0-1.2.b09.el5fixed: vendor fix RHSA-2009:1615
-
Red Hat Enterprise Linux Desktop Optional (v. 6) xerces-j2 2.7.1-12.6.el6_0, xerces-j2-demo 2.7.1-12.6.el6_0, xerces-j2-scripts 2.7.1-12.6.el6_0, xerces-j2-javadoc-xni 2.7.1-12.6.el6_0, xerces-j2-javadoc-apis 2.7.1-12.6.el6_0, xerces-j2-javadoc-impl 2.7.1-12.6.el6_0, +1 morefixed: vendor fix RHSA-2011:0858
-
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm 1.6.0.6-1jpp.3.el5, java-1.5.0-ibm 1.5.0.10-1jpp.4.el5, java-1.5.0-sun 1.5.0.20-1jpp.1.el5, java-1.6.0-sun 1.6.0.15-1jpp.1.el5, java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.6-1jpp.3.el5, +24 morefixed: vendor fix RHSA-2009:1505
-
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xerces-j2 2.7.1-7jpp.2.el5_4.2, xerces-j2-demo 2.7.1-7jpp.2.el5_4.2, xerces-j2-javadoc-xni 2.7.1-7jpp.2.el5_4.2, xerces-j2-javadoc-apis 2.7.1-7jpp.2.el5_4.2, xerces-j2-javadoc-impl 2.7.1-7jpp.2.el5_4.2, xerces-j2-javadoc-other 2.7.1-7jpp.2.el5_4.2fixed: vendor fix RHSA-2009:1615
-
Red Hat Enterprise Linux ES version 3 Extras java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-src 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-demo 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-jdbc 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-plugin 1.4.2.13.1-1jpp.1.el3 Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm 1.6.0.6-1jpp.3.el4, java-1.5.0-ibm 1.5.0.10-1jpp.4.el4, java-1.5.0-sun 1.5.0.20-1jpp.1.el4, java-1.6.0-sun 1.6.0.15-1jpp.1.el4, java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.6-1jpp.3.el4, +22 morefixed: vendor fix RHSA-2009:1505
show 15 moreshow fewer
-
Red Hat Enterprise Linux HPC Node Optional (v. 6) xerces-j2 2.7.1-12.6.el6_0, xerces-j2-demo 2.7.1-12.6.el6_0, xerces-j2-scripts 2.7.1-12.6.el6_0, xerces-j2-javadoc-xni 2.7.1-12.6.el6_0, xerces-j2-javadoc-apis 2.7.1-12.6.el6_0, xerces-j2-javadoc-impl 2.7.1-12.6.el6_0, +1 more Red Hat Enterprise Linux Server (v. 6) xerces-j2 2.7.1-12.6.el6_0 Red Hat Enterprise Linux Server Optional (v. 6) xerces-j2 2.7.1-12.6.el6_0, xerces-j2-demo 2.7.1-12.6.el6_0, xerces-j2-scripts 2.7.1-12.6.el6_0, xerces-j2-javadoc-xni 2.7.1-12.6.el6_0, xerces-j2-javadoc-apis 2.7.1-12.6.el6_0, xerces-j2-javadoc-impl 2.7.1-12.6.el6_0, +1 morefixed: vendor fix RHSA-2011:0858
-
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm 1.6.0.6-1jpp.3.el5, java-1.5.0-ibm 1.5.0.10-1jpp.4.el5, java-1.5.0-sun 1.5.0.20-1jpp.1.el5, java-1.6.0-sun 1.6.0.15-1jpp.1.el5, java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.6-1jpp.3.el5, +24 morefixed: vendor fix RHSA-2009:1505
-
Red Hat Enterprise Linux Workstation (v. 6) xerces-j2 2.7.1-12.6.el6_0 Red Hat Enterprise Linux Workstation Optional (v. 6) xerces-j2 2.7.1-12.6.el6_0, xerces-j2-demo 2.7.1-12.6.el6_0, xerces-j2-scripts 2.7.1-12.6.el6_0, xerces-j2-javadoc-xni 2.7.1-12.6.el6_0, xerces-j2-javadoc-apis 2.7.1-12.6.el6_0, xerces-j2-javadoc-impl 2.7.1-12.6.el6_0, +1 morefixed: vendor fix RHSA-2011:0858
-
Red Hat Enterprise Linux WS version 3 Extras java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-src 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-demo 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-jdbc 1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-plugin 1.4.2.13.1-1jpp.1.el3 Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm 1.6.0.6-1jpp.3.el4, java-1.5.0-ibm 1.5.0.10-1jpp.4.el4, java-1.5.0-sun 1.5.0.20-1jpp.1.el4, java-1.6.0-sun 1.6.0.15-1jpp.1.el4, java-1.4.2-ibm 1.4.2.13.1-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.6-1jpp.3.el4, +22 morefixed: vendor fix RHSA-2009:1505
-
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jboss-seam 1.2.1-1.ep1.22.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, +20 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jboss-seam 1.2.1-1.ep1.22.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, +20 morefixed: vendor fix RHSA-2009:1637
-
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jgroups 2.4.7-1.ep1.el5, jcommon 1.0.16-1.1.ep1.el5, jacorb 2.3.0-1jpp.ep1.9.1.el5, jboss-seam 1.2.1-1.ep1.14.el5, jfreechart 1.0.13-2.3.1.ep1.el5, glassfish-jsf 1.2_13-2.1.ep1.el5, +17 morefixed: vendor fix RHSA-2009:1650
-
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, jboss-aop 1.5.5-3.CP04.2.ep1.el4, +28 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, jboss-aop 1.5.5-3.CP04.2.ep1.el4, +28 morefixed: vendor fix RHSA-2009:1636
-
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jgroups 2.4.7-1.ep1.el5, jcommon 1.0.16-1.1.ep1.el5, jacorb 2.3.0-1jpp.ep1.9.1.el5, jfreechart 1.0.13-2.3.1.ep1.el5, glassfish-jsf 1.2_13-2.1.ep1.el5, jboss-aop 1.5.5-3.CP04.2.ep1.el5, +25 morefixed: vendor fix RHSA-2009:1649
-
Red Hat JBoss Operations Network 3.1fixed: vendor fix RHSA-2012:0725
-
Red Hat JBoss Portal 5.2fixed: vendor fix RHSA-2012:1232
-
Red Hat JBoss Web Framework Kit 2.2fixed: vendor fix RHSA-2013:0763
-
Red Hat Satellite 5.1 (RHEL v.4 AS) java-1.5.0-sun 1.5.0.22-1jpp.1.el4fixed: vendor fix RHSA-2009:1662
-
Red Hat Satellite 5.3 (RHEL v.4) java-1.6.0-ibm 1.6.0.7-1jpp.3.el4 Red Hat Satellite 5.3 (RHEL v.5) java-1.6.0-ibm 1.6.0.7-1jpp.2.el5fixed: vendor fix RHSA-2010:0043
-
Red Hat RHEL 4 AS for SAP java-1.4.2-ibm 1.4.2.13.2.sap-1jpp.4.el4_8, java-1.4.2-ibm-src 1.4.2.13.2.sap-1jpp.4.el4_8, java-1.4.2-ibm-demo 1.4.2.13.2.sap-1jpp.4.el4_8, java-1.4.2-ibm-javacomm 1.4.2.13.2.sap-1jpp.4.el4_8 Red Hat RHEL 5 Server for SAP java-1.4.2-ibm 1.4.2.13.2.sap-1jpp.4.el5_3, java-1.4.2-ibm-src 1.4.2.13.2.sap-1jpp.4.el5_3, java-1.4.2-ibm-demo 1.4.2.13.2.sap-1jpp.4.el5_3, java-1.4.2-ibm-javacomm 1.4.2.13.2.sap-1jpp.4.el5_3fixed: vendor fix RHSA-2009:1551
-
Red Hat RHEV-M for Servers jasperreports-server-pro 4.7.1-2.el6evfixed: vendor fix RHSA-2012:1537
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
30.38% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | xerces:xercesImpl | <2.10.0 |
2.10.0 |
References
-
sunsolve.sun.com
/search/document.do?assetkey=1-66-263489-1
vendor-advisory, web, broken-link, patch
-
openwall.com
/lists/oss-security/2009/10/22/9
mailing-list, patch, third-party-advisory
-
github.com
/apache/xerces2-j/commit/0bdf77af1d4fd26ec2e630fb6d12e2dfa77bc12b
web
-
sunsolve.sun.com
/search/document.do?assetkey=1-21-125136-16-1
web, broken-link, patch
-
svn.apache.org
/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_f
patch, vendor-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026
vendor-advisory, web, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1200.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2009-1199.html
vendor-advisory, web
-
ubuntu.com
/usn/USN-890-1
vendor-advisory
-
debian.org
/security/2010/dsa-1984
vendor-advisory, third-party-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-77-1021506.1-1
vendor-advisory, broken-link
-
redhat.com
/support/errata/RHSA-2009-1615.html
vendor-advisory, third-party-advisory
-
marc.info
/?l=bugtraq&m=125787273209737&w=2
vendor-advisory, web, mailing-list, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1637.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2012-1537.html
vendor-advisory, web, broken-link
-
lists.opensuse.org
/opensuse-security-announce/2010-06/msg00001.html
vendor-advisory, web, third-party-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2009:209
vendor-advisory, third-party-advisory
-
redhat.com
/archives/fedora-package-announce/2009-August/msg00310.html
vendor-advisory, web
-
redhat.com
/support/errata/RHSA-2011-0858.html
vendor-advisory, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1636.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2009-1649.html
vendor-advisory, web
-
sunsolve.sun.com
/search/document.do?assetkey=1-66-272209-1
vendor-advisory, web, broken-link
-
mandriva.com
/security/advisories?name=MDVSA-2011:108
vendor-advisory, third-party-advisory
-
redhat.com
/archives/fedora-package-announce/2009-August/msg00325.html
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2009-10/msg00001.html
vendor-advisory, web, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2012-1232.html
vendor-advisory, web, broken-link
-
lists.apple.com
/archives/security-announce/2009/Sep/msg00000.html
vendor-advisory, web, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2009-11/msg00002.html
vendor-advisory, web, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1201.html
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2009-10/msg00004.html
vendor-advisory, web, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1650.html
vendor-advisory, web
-
networkworld.com
/columnists/2009/080509-xml-flaw.html
third-party-advisory
-
secunia.com
/advisories/36162
third-party-advisory, web
-
vupen.com
/english/advisories/2009/2543
vdb-entry
-
secunia.com
/advisories/37460
third-party-advisory, web
- vmware.com /security/advisories/VMSA-2009-0016.html
-
secunia.com
/advisories/37754
third-party-advisory, web
-
cert.fi
/en/reports/2009/vulnerability2009085.html
third-party-advisory
-
codenomicon.com
/labs/xml/
third-party-advisory
-
secunia.com
/advisories/36199
third-party-advisory, web
-
securitytracker.com
/id?1022680
vdb-entry
-
secunia.com
/advisories/37671
third-party-advisory, web
-
secunia.com
/advisories/38342
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2009-2625
advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=512921
web
-
lists.apache.org
/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
web
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520
web
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356
web
-
snyk.io
/vuln/SNYK-JAVA-XERCES-32014
web
-
secunia.com
/advisories/36176
web, third-party-advisory
-
secunia.com
/advisories/36180
web, third-party-advisory
-
secunia.com
/advisories/37300
web, third-party-advisory
-
secunia.com
/advisories/38231
web, third-party-advisory
-
secunia.com
/advisories/43300
web, third-party-advisory
-
secunia.com
/advisories/50549
web, third-party-advisory
-
openwall.com
/lists/oss-security/2009/09/06/1
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2009/10/23/6
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2009/10/26/3
mailing-list, third-party-advisory
-
oracle.com
/technetwork/topics/security/cpujan2010-084891.html
third-party-advisory
-
oracle.com
/technetwork/topics/security/cpuoct2009-096303.html
broken-link
Sources
- CVE List CVE-2009-2625
- GitHub Advisory GHSA-334p-wv2m-w3vp
- NVD CVE-2009-2625
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.