It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.
Public now via Oracle CPU July 2016, fixed in Oracle JDK 8u101, 7u111, and 6u121. External References: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA
OpenJDK 8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/b03b69adc909
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:1458 https://access.redhat.com/errata/RHSA-2016:1458
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2016:1477 https://access.redhat.com/errata/RHSA-2016:1477
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2016:1476 https://access.redhat.com/errata/RHSA-2016:1476
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 7 Via RHSA-2016:1475 https://access.redhat.com/errata/RHSA-2016:1475
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:1504 https://rhn.redhat.com/errata/RHSA-2016-1504.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2016:1776 https://rhn.redhat.com/errata/RHSA-2016-1776.html