R3Dw0Lfsec

The `EndpointReferenceUtils` and `W3CMultiSchemaFactory` classes construct a `SAXParserFactory` without the required JAXP hardening configurations. This allows for out-of-band (OOB) external entity resolution, a process where an XML parser is tricked into accessing external resources via external entities.

Deserialization of untrusted data in the Java replace-resolve path on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks. By using crafted Fory serialized data, an attacker can invoke `readResolve()` and `readExternal()` hooks present on the classpath.