CVE-2019-9658: Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle

The vulnerability stems from Checkstyle's XML configuration parser allowing external DTD resolution by default. The CWE-611 indicates improper restriction of XML external entity references. The GitHub issues (#6474, #6478) and release notes for 8.18 confirm that the fix involved disabling external DTD loading. The functions responsible for initializing the XML parser (e.g., ConfigurationLoader methods) would have lacked secure feature configuration (like FEATURE_SECURE_PROCESSING) prior to the patch. These functions are critical points where XML parsing security settings are applied, making them the likely vulnerable components.