...
We are aware that the Apache Lucene project had been distributing its own patched version of Xerces to resolve a problem they were having. The Xerces JIRA issue reported for the problem continues to remain open today because we have been waiting for a consumable test case to be provided. The initial reporter's test was 20 GBs, too large for many to download and analyze. Apparently Lucene has since implemented a work around workaround and stopped distributing their own Xerces version. We certainly welcome the Lucene developers engagement if they're still interested in a resolution. With more direct communication on the mailing lists this issue might have already been resolved a long time ago.
...