CVE-2009-1885
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2...
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
Exploit likelihood
What each source reports
NVD Score used
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
CVE-2009-1885- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
CVE-2009-1885- Updated
- 2026-11-02
EUVDEUVD-2009-1880 No score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
EUVD-2009-1880- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m76p-wpqx-3m7x No score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2...
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
GHSA-m76p-wpqx-3m7x- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
CVE-2009-1885- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-1885 No score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
DEBIAN-CVE-2009-1885- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10039-1 No score
libxerces-c-3_1-3.1.4-1.3 on GA media
These are all security issues fixed in the libxerces-c-3_1-3.1.4-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10039-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1885 is a medium vulnerability (CVSS 4.3) in Apache Xerces-c\+\+, published August 11, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.32%, the 92nd percentile. Fixed in xerces-c 3.0.1-2.
References
securityfocus.com/bid/35986
networkworld.com/columnists/2009/080509-xml-flaw.html
cert.fi/en/reports/2009/vulnerability2009085.html
codenomicon.com/labs/xml
redhat.com/archives/fedora-package-announce/2009-August/msg01136.html
secunia.com/advisories/36201
Show 16 moreShow less
vupen.com/english/advisories/2009/2196
svn.apache.org/viewvc/xerces/c/trunk/src/xercesc/validators/DTD/DTDScanner.cpp?r1=781488&r2=781487&pathrev=781488&view=patch
mandriva.com/security/advisories?name=MDVSA-2009:223
exchange.xforce.ibmcloud.com/vulnerabilities/52321
bugzilla.redhat.com/show_bug.cgi?id=515515
nvd.nist.gov/vuln/detail/CVE-2009-1885
github.com/advisories/GHSA-m76p-wpqx-3m7x
security-tracker.debian.org/tracker/CVE-2009-1885
suse.com/security/cve/CVE-2009-1885