CVE-2020-14338

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.

• CWE-20
• CWE-20

• https://bugzilla.redhat.com/show_bug.cgi?id=1860054Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E
• https://bugzilla.redhat.com/show_bug.cgi?id=1860054Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E

Published

Sep 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14332A flaw was found in the Ansible Engine when using module_arg…5.5
• CVE-2020-14333A flaw was found in Ovirt Engine's web interface in ovirt 4.…6.1
• CVE-2020-14334A flaw was found in Red Hat Satellite 6 which allows privile…8.8
• CVE-2020-14335A flaw was found in Red Hat Satellite, which allows a privil…5.5
• CVE-2020-14336A flaw was found in the Restricted Security Context Constrai…6.5
• CVE-2020-14337A data exposure flaw was found in Tower, where sensitive dat…5.8
• CVE-2020-14339A flaw was found in libvirt, where it leaked a file descript…8.8
• CVE-2020-1434An elevation of privilege vulnerability exists in the way th…5.3
• CVE-2020-14340A vulnerability was discovered in XNIO where file descriptor…5.9
• CVE-2020-14341The "Test Connection" available in v7.x of the Red Hat Singl…2.7
• CVE-2020-14342It was found that cifs-utils' mount.cifs was invoking a shel…7
• CVE-2020-14343A vulnerability was discovered in the PyYAML library in vers…9.8