diff --git a/History.md b/History.md
index 8dafe13d..4ac39713 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,6 @@
 - support parsing of BT-90 CreditorReferenceID
 - #870
-- #871 sec
+- #871
 - #868
 - #729
 - #863
diff --git a/validator/src/main/java/org/mustangproject/validator/PDFValidator.java b/validator/src/main/java/org/mustangproject/validator/PDFValidator.java
index 411eb220..efe96b60 100644
--- a/validator/src/main/java/org/mustangproject/validator/PDFValidator.java
+++ b/validator/src/main/java/org/mustangproject/validator/PDFValidator.java
@@ -12,6 +12,7 @@ import java.util.Calendar;
 import java.util.EnumSet;
 import java.util.HashMap;
 
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
@@ -127,7 +128,6 @@ public class PDFValidator extends Validator {
 		zi.setInputStream(inputStream);
 		final String xmp = zi.getXMP();
 
-		final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 		final Document docXMP;
 
 		if (xmp == null || xmp.length() == 0) {
@@ -142,6 +142,11 @@ public class PDFValidator extends Validator {
 		 * <zf:Version>1.0</zf:Version>
 		 */
 		try {
+			final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+			// and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"
+			factory.setXIncludeAware(false);
+
 			final DocumentBuilder builder = factory.newDocumentBuilder();
 			final InputSource is = new InputSource(new StringReader(xmp));
 			docXMP = builder.parse(is);