--- a/jaxp/src/com/sun/org/apache/xerces/internal/parsers/DTDConfiguration.java	Wed Jul 05 19:08:14 2017 +0200
+++ b/jaxp/src/com/sun/org/apache/xerces/internal/parsers/DTDConfiguration.java	Tue Aug 20 17:41:16 2013 -0700
@@ -38,6 +38,7 @@
 import com.sun.org.apache.xerces.internal.util.PropertyState;
 import com.sun.org.apache.xerces.internal.util.Status;
 import com.sun.org.apache.xerces.internal.util.SymbolTable;
+import com.sun.org.apache.xerces.internal.utils.XMLSecurityPropertyManager;
 import com.sun.org.apache.xerces.internal.xni.XMLLocator;
 import com.sun.org.apache.xerces.internal.xni.XNIException;
 import com.sun.org.apache.xerces.internal.xni.grammars.XMLGrammarPool;
@@ -184,6 +185,10 @@
     protected static final String LOCALE =
         Constants.XERCES_PROPERTY_PREFIX + Constants.LOCALE_PROPERTY;
 
+    /** Property identifier: Security property manager. */
+    protected static final String XML_SECURITY_PROPERTY_MANAGER =
+            Constants.XML_SECURITY_PROPERTY_MANAGER;
+
     // debugging
 
     /** Set to true and recompile to print exception stack trace. */
@@ -328,7 +333,8 @@
             VALIDATION_MANAGER,
             JAXP_SCHEMA_SOURCE,
             JAXP_SCHEMA_LANGUAGE,
-            LOCALE
+            LOCALE,
+            XML_SECURITY_PROPERTY_MANAGER
         };
         addRecognizedProperties(recognizedProperties);
 
@@ -406,6 +412,7 @@
             // REVISIT: What is the right thing to do? -Ac
         }
 
+        setProperty(XML_SECURITY_PROPERTY_MANAGER, new XMLSecurityPropertyManager());
     } // <init>(SymbolTable,XMLGrammarPool)
 
     //

--- a/jaxp/src/com/sun/org/apache/xerces/internal/parsers/NonValidatingConfiguration.java	Wed Jul 05 19:08:14 2017 +0200
+++ b/jaxp/src/com/sun/org/apache/xerces/internal/parsers/NonValidatingConfiguration.java	Tue Aug 20 17:41:16 2013 -0700
@@ -36,6 +36,7 @@
 import com.sun.org.apache.xerces.internal.util.PropertyState;
 import com.sun.org.apache.xerces.internal.util.Status;
 import com.sun.org.apache.xerces.internal.util.SymbolTable;
+import com.sun.org.apache.xerces.internal.utils.XMLSecurityPropertyManager;
 import com.sun.org.apache.xerces.internal.xni.XMLLocator;
 import com.sun.org.apache.xerces.internal.xni.XNIException;
 import com.sun.org.apache.xerces.internal.xni.grammars.XMLGrammarPool;
@@ -157,6 +158,10 @@
     protected static final String LOCALE =
         Constants.XERCES_PROPERTY_PREFIX + Constants.LOCALE_PROPERTY;
 
+    /** Property identifier: Security property manager. */
+    protected static final String XML_SECURITY_PROPERTY_MANAGER =
+            Constants.XML_SECURITY_PROPERTY_MANAGER;
+
     // debugging
 
     /** Set to true and recompile to print exception stack trace. */
@@ -310,7 +315,8 @@
             XMLGRAMMAR_POOL,
             DATATYPE_VALIDATOR_FACTORY,
             VALIDATION_MANAGER,
-            LOCALE
+            LOCALE,
+            XML_SECURITY_PROPERTY_MANAGER
         };
         addRecognizedProperties(recognizedProperties);
 
@@ -367,6 +373,7 @@
             // REVISIT: What is the right thing to do? -Ac
         }
 
+        setProperty(XML_SECURITY_PROPERTY_MANAGER, new XMLSecurityPropertyManager());
     } // <init>(SymbolTable,XMLGrammarPool)
 
     //

--- a/jaxp/src/com/sun/org/apache/xerces/internal/parsers/SAXParser.java	Wed Jul 05 19:08:14 2017 +0200
+++ b/jaxp/src/com/sun/org/apache/xerces/internal/parsers/SAXParser.java	Tue Aug 20 17:41:16 2013 -0700
@@ -76,6 +76,7 @@
         XMLGRAMMAR_POOL,
     };
 
+    XMLSecurityPropertyManager securityPropertyManager;
     //
     // Constructors
     //
@@ -129,16 +130,19 @@
      */
     public void setProperty(String name, Object value)
         throws SAXNotRecognizedException, SAXNotSupportedException {
-        XMLSecurityPropertyManager spm = new XMLSecurityPropertyManager();
-        int index = spm.getIndex(name);
+        if (securityPropertyManager == null) {
+            securityPropertyManager = new XMLSecurityPropertyManager();
+        }
+        int index = securityPropertyManager.getIndex(name);
+
         if (index > -1) {
             /**
              * this is a direct call to this parser, not a subclass since
              * internally the support of this property is done through
              * XMLSecurityPropertyManager
              */
-            spm.setValue(index, XMLSecurityPropertyManager.State.APIPROPERTY, (String)value);
-            super.setProperty(Constants.XML_SECURITY_PROPERTY_MANAGER, spm);
+            securityPropertyManager.setValue(index, XMLSecurityPropertyManager.State.APIPROPERTY, (String)value);
+            super.setProperty(Constants.XML_SECURITY_PROPERTY_MANAGER, securityPropertyManager);
         } else {
             super.setProperty(name, value);
         }