Reported by snyk.io https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-1655558 Upgrading from 2.2.0 to 2.2.3 seems to be the fix