CVE-2014-0054: Spring Framework Jaxb2RootElementHttpMessageConverter XXE flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw allows file disclosure, denial of service, and CSRF, and EPSS indicates a very high probability of exploitation activity, though no KEV listing or public exploit reference is present.

What it is

The Jaxb2RootElementHttpMessageConverter in Spring MVC does not disable external entity resolution, allowing crafted XML to trigger an XML External Entity (XXE) issue. This is an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429, so systems patched for those earlier issues may still be exposed.

Impact

A remote attacker can read arbitrary files, cause a denial of service, and conduct CSRF attacks. The CVSS 2.0 vector shows partial confidentiality, integrity, and availability impact.

Attack surface

Reached over the network via crafted XML submitted to a Spring MVC endpoint that uses Jaxb2RootElementHttpMessageConverter. The CVSS vector indicates no authentication is required, though attack complexity is medium.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is very high at 0.91354 (99.8th percentile), but the record contains no reference tags indicating a public exploit.

What to do

• Upgrade Spring Framework to 3.2.8 or later, or 4.0.2 or later, which contain the complete fix.
• If immediate upgrade is not possible, disable external entity resolution in the XML parser used by Jaxb2RootElementHttpMessageConverter.
• Apply vendor errata such as RHSA-2014-0400 where applicable.
• Review and restrict XML endpoints that accept untrusted input.

Detection

• Monitor for XML payloads containing DOCTYPE declarations or external entity references sent to Spring MVC endpoints.
• Alert on unexpected outbound network connections or file reads originating from the application server.
• Audit Spring Framework versions in use to identify deployments below 3.2.8 or 4.0.2.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.