DOMParser, JDOMParser and the deprecated XMLDocumentContainer transform path parse XML from a caller-supplied URL/Source without turning off external entities, so a document carrying an external general entity like gets resolved at parse time and its contents land in the tree, which is the usual file-read / SSRF XXE. The fix turns off external general/parameter entities and external DTD loading inside each parser while leaving the internal DTD subset working, so the existing Vendor.xml style documents still parse. One thing I went back and forth on: for JDOM the SAX feature flags alone are not enough because setExpandEntities(true) re-enables external general entities afterward, so I refuse external lookups with a no-op EntityResolver there instead.