[
https://issues.apache.org/jira/browse/TIKA-4938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120154#comment-18120154
]
Tim Allison commented on TIKA-4938:
-----------------------------------
Separately, shout out to [~ggregory] for his work on:
https://issues.apache.org/jira/browse/TIKA-4935
> Migrate xfa parsing from stax to sax and cherry-pick back to 3.x
> ----------------------------------------------------------------
>
> Key: TIKA-4938
> URL: https://issues.apache.org/jira/browse/TIKA-4938
> Project: Tika
> Issue Type: Task
> Reporter: Tim Allison
> Priority: Minor
>
> CVE-2025-66516 was caused by finicky behavior in the JVM around return types
> for external entity handling in the stax parser. We found further
> differential behavior if woodstox is on the classpath (which it is in
> tika-server).
> On this ticket, I propose simplifying our parsing of xfa and our parser
> configuration and moving xfa parsing to sax. We should deprecate the stax
> handling in XMLReaderUtils and try to keep any new xml parsing to SAX or DOM
> (only if necessary).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
