Hazelcast error after upgrading spring boot from 2.3.5 to 2.6.6

Question

To fix the Springshell vulnerability, I have upgraded the spring version from 5.2.10.RELEASE to 5.3.18 and Spring boot from 2.3.5.RELEASE to 2.6.6. Here we are also using hazelcast-hibernate53 which also got upgraded from 1.3.2 to 2.2.1 After upgrading that I have started getting exception related to the hazelcast xml and xerces.

Found some solution like adding the hazelcast-hibernate53 1.3.2 dependency manually also tried upgrading the xerces version from 2.12.0 to 2.12.2 but didn't worked.

These are the error logs which I am getting Any help and suggestion would be appriciated.

Caused by: java.lang.IllegalStateException: Cache provider not started
at org.hibernate.cache.spi.AbstractRegionFactory.verifyStarted(AbstractRegionFactory.java:65)
at org.hibernate.cache.spi.support.RegionFactoryTemplate.buildTimestampsRegion(RegionFactoryTemplate.java:66)
at org.hibernate.cache.internal.EnabledCaching.<init>(EnabledCaching.java:85)
at org.hibernate.engine.spi.CacheInitiator.initiateService(CacheInitiator.java:34)
at org.hibernate.engine.spi.CacheInitiator.initiateService(CacheInitiator.java:24)
at org.hibernate.service.spi.SessionFactoryServiceInitiator.initiateService(SessionFactoryServiceInitiator.java:30)
at org.hibernate.service.internal.SessionFactoryServiceRegistryImpl.initiateService(SessionFactoryServiceRegistryImpl.java:64)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.createService(AbstractServiceRegistryImpl.java:263)
... 29 common frames omitted
Caused by: org.hibernate.cache.CacheException: com.hazelcast.core.HazelcastException: org.xml.sax.SAXNotRecognizedException: Property 'http://javax.xml.XMLConstants/property/accessExternalSchema' is not recognized.
at com.hazelcast.hibernate.instance.DefaultHazelcastInstanceFactory.createInstanceLoader(DefaultHazelcastInstanceFactory.java:38)
at com.hazelcast.hibernate.AbstractHazelcastCacheRegionFactory.resolveInstanceLoader(AbstractHazelcastCacheRegionFactory.java:163)
at com.hazelcast.hibernate.AbstractHazelcastCacheRegionFactory.prepareForUse(AbstractHazelcastCacheRegionFactory.java:146)
at org.hibernate.cache.spi.AbstractRegionFactory.start(AbstractRegionFactory.java:91)
at org.hibernate.cache.internal.EnabledCaching.<init>(EnabledCaching.java:82)
... 34 common frames omitted
Caused by: com.hazelcast.core.HazelcastException: org.xml.sax.SAXNotRecognizedException: Property 'http://javax.xml.XMLConstants/property/accessExternalSchema' is not recognized.
at com.hazelcast.internal.util.ExceptionUtil.lambda$static$0(ExceptionUtil.java:56)
at com.hazelcast.internal.util.ExceptionUtil.peel(ExceptionUtil.java:134)
at com.hazelcast.internal.util.ExceptionUtil.peel(ExceptionUtil.java:77)
at com.hazelcast.internal.util.ExceptionUtil.rethrow(ExceptionUtil.java:139)
at com.hazelcast.config.XmlConfigBuilder.build(XmlConfigBuilder.java:153)
at com.hazelcast.config.UrlXmlConfig.<init>(UrlXmlConfig.java:92)
at com.hazelcast.config.UrlXmlConfig.<init>(UrlXmlConfig.java:74)
at com.hazelcast.internal.config.ConfigLoader.load(ConfigLoader.java:44)
at com.hazelcast.hibernate.instance.HazelcastInstanceLoader.configure(HazelcastInstanceLoader.java:56)
at com.hazelcast.hibernate.instance.DefaultHazelcastInstanceFactory.createInstanceLoader(DefaultHazelcastInstanceFactory.java:35)
... 38 common frames omitted
Caused by: org.xml.sax.SAXNotRecognizedException: Property 'http://javax.xml.XMLConstants/property/accessExternalSchema' is not recognized.
at org.apache.xerces.jaxp.validation.XMLSchemaFactory.setProperty(Unknown Source)
at com.hazelcast.internal.util.XmlUtil.setProperty(XmlUtil.java:209)
at com.hazelcast.internal.util.XmlUtil.getSchemaFactory(XmlUtil.java:90)
at com.hazelcast.config.AbstractXmlConfigHelper.schemaValidation(AbstractXmlConfigHelper.java:113)
at com.hazelcast.config.XmlConfigBuilder.parseAndBuildConfig(XmlConfigBuilder.java:169)
at com.hazelcast.config.XmlConfigBuilder.build(XmlConfigBuilder.java:151)
... 43 common frames omitted

Answer 1

If you really need xerces you can add the following system property when you start the JVM as a workaround:

-Dhazelcast.ignoreXxeProtectionFailures=true

The problem is that xerces doesn't support JAXB 1.5. If you don't depend on any specific xerces functionality a simple solution is to simply remove xerces from your classpath, a default implementation, which supports the property, will be used.