CVE-2017-12621: During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM"...

Security readout for executives and security teams

Apache Commons Jelly 1.0 can make unexpected network connections while parsing certain Jelly XML files. If an application parses attacker-controlled Jelly content, this may enable XML External Entity behavior and expose internal systems to unwanted outbound requests. Exposure is most likely where Apache Commons Jelly 1.0 parses untrusted or user-supplied Jelly XML. Systems only using Jelly for trusted, bundled templates have lower practical exposure, but should still verify dependency versions. Treat this as dependency cleanup with targeted urgency. Prioritize internet-facing or partner-facing systems that accept XML-like templates or workflow files, because business impact depends on whether untrusted Jelly content reaches parsing code. Mitigation focus: Upgrade Apache Commons Jelly away from version 1.0, following Apache guidance for 1.0.1 or later.; Do not parse untrusted Jelly XML unless the business requirement is explicit and controlled.; Review XML parser settings for external entity and external DTD resolution controls..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.