Apache Commons Digester is a Java library from the Apache Commons project that converts XML documents into trees of Java objects.
Apache Commons Digester creates its SAX parser factory with no protections against document type definitions or external entities, and the default entity resolver resolves unregistered external entities, so any application that parses untrusted XML with Digester is exposed to local file disclosure, server-side request forgery, and entity-expansion denial of service. Commons libraries are designed to operate on trusted or application-validated input, so applications should not parse untrusted XML with Digester without hardening the parser factory.