CVE-2024-23807: Apache Xerces C++: Use-after-free on external DTD scan

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-02-29 · updated 2026-06-17
Weakness: CWE-416

Description

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.

Affected products

Apache Software Foundation Apache Xerces C++: from 3.0.0 before 3.2.5 — fixed in 3.2.5

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Xerces C++ 3.2.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-23807 or the next vulnerability affects your stack