maven package report

Is xerces:xercesImpl safe?

4 known vulnerabilities, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

16.4%

chance of exploitation in the next 30 days

xyz score

3.9

CyberXYZ composite, out of 10

fig. 01 — GHSA-vmqm-g3vh-847m, the advisory selected below

// advisories

GHSA-vmqm-g3vh-847m

HIGHCVE-2012-0881

Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

Affected: < 2.12.0
Fixed in: 2.12.0
Weakness: CWE-400
Published: 2020-06-15
Source: github

GHSA NVD MITRE reference reference reference reference reference reference reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 03:35 UTC. The most recent advisory here was published 2022-02-15. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is xerces:xercesImpl safe? maven package security report | CyberXYZ