The following security advisories apply to current versions of Xerces-C and have not been fixed, in most cases due to insufficient expertise or resources:

• CVE-2018-1311: Apache Xerces-C use-after-free vulnerability scanning external DTD

The following security advisories apply to versions of Xerces-C older than V3.2.1:

• CVE-2017-12627: Apache Xerces-C DTD vulnerability processing external paths

The following security advisories apply to versions of Xerces-C older than V3.1.4:

• CVE-2016-4463: Apache Xerces-C XML Parser Crashes on Malformed DTD

The following security advisories apply to versions of Xerces-C older than V3.1.3:

• CVE-2016-0729: Apache Xerces-C XML Parser Crashes on Malformed Input

The following security advisories apply to versions of Xerces-C older than V3.1.2:

• CVE-2015-0252: Apache Xerces-C XML Parser Crashes on Malformed Input