RDF4J 5.3.2 is now available. This is a patch release fixing 2 issues, including a security fix for XML parsing.
The security fix is a follow-up to CVE-2018-1000644. Several XML parser entry points were not covered by the earlier fix and could still allow XML External Entity (XXE) style processing in some configurations. RDF4J 5.3.2 hardens these paths so DOCTYPE declarations, external entities, and external DTD loading are rejected or disabled by default.
We recommend that users who parse untrusted XML-based RDF4J data or query results upgrade to this release.
For more details, have a look at the release notes.