diff --git a/commons-digester3-core/pom.xml b/commons-digester3-core/pom.xml
index 763cd337c..d04cf94f4 100644
--- a/commons-digester3-core/pom.xml
+++ b/commons-digester3-core/pom.xml
@@ -34,6 +34,11 @@
   <name>Apache Commons Digester :: Core</name>
 
   <dependencies>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-secure-xml</artifactId>
+      <version>1.0.0</version>
+    </dependency>
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib</artifactId>
diff --git a/commons-digester3-core/src/main/java/org/apache/commons/digester3/Digester.java b/commons-digester3-core/src/main/java/org/apache/commons/digester3/Digester.java
index 5aa17f36f..dc8a7781a 100644
--- a/commons-digester3-core/src/main/java/org/apache/commons/digester3/Digester.java
+++ b/commons-digester3-core/src/main/java/org/apache/commons/digester3/Digester.java
@@ -48,6 +48,7 @@
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.apache.commons.xml.secure.SecureSAXParserFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.ContentHandler;
 import org.xml.sax.EntityResolver;
@@ -1589,7 +1590,7 @@ public SAXParserFactory getFactory()
     {
         if ( factory == null )
         {
-            factory = SAXParserFactory.newInstance();
+            factory = SecureSAXParserFactory.newInstance();
             factory.setNamespaceAware( namespaceAware );
             factory.setXIncludeAware( xincludeAware );
             factory.setValidating( validating );
diff --git a/commons-digester3-core/src/main/java/org/apache/commons/digester3/NodeCreateRule.java b/commons-digester3-core/src/main/java/org/apache/commons/digester3/NodeCreateRule.java
index 87bd7ef21..7882fab47 100644
--- a/commons-digester3-core/src/main/java/org/apache/commons/digester3/NodeCreateRule.java
+++ b/commons-digester3-core/src/main/java/org/apache/commons/digester3/NodeCreateRule.java
@@ -23,6 +23,7 @@
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.w3c.dom.Attr;
 import org.w3c.dom.DOMException;
 import org.w3c.dom.Document;
@@ -335,7 +336,7 @@ public NodeCreateRule( final DocumentBuilder documentBuilder )
     public NodeCreateRule( final int nodeType )
         throws ParserConfigurationException
     {
-        this( nodeType, DocumentBuilderFactory.newInstance().newDocumentBuilder() );
+        this( nodeType, SecureDocumentBuilderFactory.newInstance().newDocumentBuilder() );
     }
 
     /**
diff --git a/commons-digester3-core/src/main/java/org/apache/commons/digester3/binder/DigesterLoader.java b/commons-digester3-core/src/main/java/org/apache/commons/digester3/binder/DigesterLoader.java
index 0fa0c2069..8cf5cd20e 100644
--- a/commons-digester3-core/src/main/java/org/apache/commons/digester3/binder/DigesterLoader.java
+++ b/commons-digester3-core/src/main/java/org/apache/commons/digester3/binder/DigesterLoader.java
@@ -43,6 +43,7 @@
 import org.apache.commons.digester3.RulesBase;
 import org.apache.commons.digester3.StackAction;
 import org.apache.commons.digester3.Substitutor;
+import org.apache.commons.xml.secure.SecureSAXParserFactory;
 import org.xml.sax.EntityResolver;
 import org.xml.sax.ErrorHandler;
 import org.xml.sax.Locator;
@@ -107,7 +108,7 @@ public static DigesterLoader newLoader( final RulesModule... rulesModules )
     /**
      * The SAXParserFactory to create new default {@link Digester} instances.
      */
-    private final SAXParserFactory factory = SAXParserFactory.newInstance();
+    private final SAXParserFactory factory = SecureSAXParserFactory.newInstance();
 
     private final Iterable<RulesModule> rulesModules;
 
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 241d9c42e..645b96cc1 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -27,6 +27,9 @@
     <action dev="simonetripodi" type="add" issue="DIGESTER-171" due-to="Nick Williams, Ivan Diana">Add DefaultThrowingErrorHandler to Digester API.</action>
     <action dev="ggregory" type="add" due-to="Gary Gregory">Add Maven property project.build.outputTimestamp for build reproducibility.</action>
     <!--  FIX -->
+    <action dev="pkarwasz" type="fix" due-to="Piotr P. Karwasz, Gary Gregory">
+      Create SAX parser and document builder factories through org.apache.commons:commons-secure-xml, which bounds entity expansion and enables XML secure processing.
+    </action>
     <action dev="simonetripodi" type="fix" issue="DIGESTER-175">
       Regression: DigesterTestCase#testPopNamedStackNotPushed expects EmptyStackException.
     </action>