diff --git a/bundle/core/src/main/java/org/apache/karaf/bundle/core/internal/MavenConfigService.java b/bundle/core/src/main/java/org/apache/karaf/bundle/core/internal/MavenConfigService.java
index 3227385fff7..fce70702a96 100644
--- a/bundle/core/src/main/java/org/apache/karaf/bundle/core/internal/MavenConfigService.java
+++ b/bundle/core/src/main/java/org/apache/karaf/bundle/core/internal/MavenConfigService.java
@@ -86,7 +86,10 @@ static String getLocalRepoFromConfig(Dictionary<String, Object> dict) {
 	private static String getLocalRepositoryFromSettings(File file) {
 		XMLStreamReader reader = null;
 		try (InputStream fin = new FileInputStream(file)) {
-			reader = XMLInputFactory.newFactory().createXMLStreamReader(fin);
+			XMLInputFactory factory = XMLInputFactory.newFactory();
+			factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+			factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+			reader = factory.createXMLStreamReader(fin);
 		    int event;
 		    String elementName = null;
 		    while ((event = reader.next()) != XMLStreamConstants.END_DOCUMENT) {
diff --git a/deployer/features/src/main/java/org/apache/karaf/deployer/features/FeatureDeploymentListener.java b/deployer/features/src/main/java/org/apache/karaf/deployer/features/FeatureDeploymentListener.java
index 5c4c7eed8f5..7f784938917 100644
--- a/deployer/features/src/main/java/org/apache/karaf/deployer/features/FeatureDeploymentListener.java
+++ b/deployer/features/src/main/java/org/apache/karaf/deployer/features/FeatureDeploymentListener.java
@@ -265,6 +265,8 @@ public synchronized void bundleChanged(BundleEvent bundleEvent) {
     private QName getRootElementName(File artifact) throws Exception {
         if (xif == null) {
             xif = XMLInputFactory.newFactory();
+            xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+            xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
             xif.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true);
         }
         try (InputStream is = new FileInputStream(artifact)) {
diff --git a/deployer/spring/src/main/java/org/apache/karaf/deployer/spring/SpringDeploymentListener.java b/deployer/spring/src/main/java/org/apache/karaf/deployer/spring/SpringDeploymentListener.java
index d49ba74a543..0953f663e4f 100644
--- a/deployer/spring/src/main/java/org/apache/karaf/deployer/spring/SpringDeploymentListener.java
+++ b/deployer/spring/src/main/java/org/apache/karaf/deployer/spring/SpringDeploymentListener.java
@@ -71,6 +71,8 @@ protected StartElement getRootElement(File artifact) throws Exception {
     	try {
 			if (factory == null) {
 				factory = XMLInputFactory.newInstance();
+				factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+				factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
 			}
 			in = new FileInputStream(artifact);
 			parser = factory.createXMLEventReader(in);
diff --git a/features/core/src/main/java/org/apache/karaf/features/internal/service/FeaturesProcessingSerializer.java b/features/core/src/main/java/org/apache/karaf/features/internal/service/FeaturesProcessingSerializer.java
index 21823823d8b..a92e825d86c 100644
--- a/features/core/src/main/java/org/apache/karaf/features/internal/service/FeaturesProcessingSerializer.java
+++ b/features/core/src/main/java/org/apache/karaf/features/internal/service/FeaturesProcessingSerializer.java
@@ -162,7 +162,10 @@ public void write(FeaturesProcessing model, OutputStream output) {
             Properties props = new Properties();
             props.load(getClass().getResourceAsStream("feature-processing-comments.properties"));
 
-            XMLEventReader xmlEventReader = XMLInputFactory.newFactory().createXMLEventReader(new ByteArrayInputStream(baos.toByteArray()));
+            XMLInputFactory factory = XMLInputFactory.newFactory();
+            factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+            factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+            XMLEventReader xmlEventReader = factory.createXMLEventReader(new ByteArrayInputStream(baos.toByteArray()));
             XMLEventWriter xmlEventWriter = new IndentingXMLEventWriter(XMLOutputFactory.newFactory().createXMLEventWriter(writer), "    ");
             XMLEventFactory evFactory = XMLEventFactory.newFactory();
             int depth = 0;
diff --git a/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/AssemblyMojo.java b/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/AssemblyMojo.java
index 7a80f851e5a..62f25921518 100644
--- a/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/AssemblyMojo.java
+++ b/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/AssemblyMojo.java
@@ -832,6 +832,8 @@ private String getType(Artifact artifact) {
             try (InputStream is = new FileInputStream(artifact.getFile())) {
                 XMLInputFactory xif = XMLInputFactory.newFactory();
                 xif.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true);
+                xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+                xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
                 XMLStreamReader r = xif.createXMLStreamReader(is);
                 r.nextTag();
                 QName name = r.getName();