Affected versions of this package are vulnerable to XML External Entity (XXE) Injection in the createParser method of PatternParser, which sets only http://apache.org/xml/features/nonvalidating/load-external-dtd to false and leaves disallow-doctype-decl, external-general-entities, external-parameter-entities, XMLConstants.FEATURE_SECURE_PROCESSING, and setXIncludeAware(false) unset. An attacker can read files readable by the JVM, reach internal network services including cloud metadata endpoints, and exhaust the heap through nested entity expansion by supplying a hyphenation pattern document whose internal DTD subset declares the entities, since blocking the external DTD fetch leaves an inline subset fully resolvable. This requires the application to accept a hyphenation pattern document or directory it does not control, through Hyphenator.getHyphenationTree, Hyphenator.setHyphenationDirectory, or HyphenationTree.loadPatterns, and whether file contents become visible depends on how the parsed data reaches output, logs, or error messages, though the expansion and out of band parameter entity paths need no such reflection.
Note: Version 7.1.13 installs an EntityResolver that returns an empty source, which neutralizes the file read, SSRF, and out of band loading paths that depend on resolving external entities, while leaving entity expansion intact. Version 7.1.16 replaces the reader with XmlProcessorCreator.createSafeXMLReader, which sets disallow-doctype-decl, both external entity features, load-external-dtd, and setXIncludeAware(false), closing the remainder including the expansion path.
