3745750 - Punchout setup request failed with error "DOCTYPE is disallowed" after JDK 21/Spring 6.2 upgrade - SAP Commerce Cloud

• After migrating to JDK 21 and Spring Security 6.2, POST requests to /punchout/cxml/setup return 403 Forbidden when sent as cXML from an external procurement system.

• Application logs show: 

  "message": "Could not unmarshal to [class org.cxml.CXML]: jakarta.xml.bind.UnmarshalException - with linked exception: [org.xml.sax.SAXParseException; lineNumber: 2; columnNumber: 10; DOCTYPE is disallowed when the feature \"http://apache.org/xml/features/disallow-doctype-decl\" set to true.]", "name":"org.springframework.http.converter.HttpMessageNotReadableException", "cause":{"commonElementCount":128,"name":"jakarta.xml.bind.UnmarshalException", "cause":{"commonElementCount":128,"localizedMessage":"DOCTYPE is disallowed when the feature \"http://apache.org/xml/features/disallow-doctype-decl\" set to true.", "message":"DOCTYPE is disallowed when the feature \"http://apache.org/xml/features/disallow-doctype-decl\" set to true.", "name":"org.xml.sax.SAXParseException"

SAP Commerce Cloud

punchout, cxml, doctype, disallow-doctype-decl, jdk21, java 21, spring security 6.2, jaxb, 404 error, httpmessagenotreadableexception, unmarshallexception, saxparseexception , KBA , CEC-SCC-COM-BBA-PUN , Punchout , Problem