diff --git a/src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java b/src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java
index 7a0cad0d..bab251ec 100644
--- a/src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java
+++ b/src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java
@@ -144,6 +144,7 @@ public static C3P0Config extractXmlConfigFromDefaultResource() throws Exception
     public static C3P0Config extractXmlConfigFromInputStream(InputStream is) throws Exception
     {
         DocumentBuilderFactory fact = DocumentBuilderFactory.newInstance();
+	fact.setExpandEntityReferences(false);
         DocumentBuilder db = fact.newDocumentBuilder();
         Document doc = db.parse( is );