...
We are aware that the Apache Lucene project had been distributing its own patched version of Xerces to resolve an issue a problem they were having. The Xerces JIRA issue reported for the problem continues to remain open today because a test case that would be consumable by the Xerces developers was never provided. The initial reporter's test was 20 GBs, too large for many to download. Apparently Lucene has since implemented a work around and stopped distributing their own Xerces version. We certainly welcome the Lucene developers engagement if they're still interested in a resolution.
...