diff --git a/media/jaxb/pom.xml b/media/jaxb/pom.xml
index 7d302abe21..acba11ffb1 100644
--- a/media/jaxb/pom.xml
+++ b/media/jaxb/pom.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2015, 2019 Oracle and/or its affiliates. All rights reserved.
+    Copyright (c) 2015, 2020 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
     terms of the Eclipse Public License v. 2.0, which is available at
@@ -110,6 +110,14 @@
                     <unpackBundle>true</unpackBundle>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <forkCount>2</forkCount>
+                    <reuseForks>true</reuseForks>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/FeatureSupplier.java b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/FeatureSupplier.java
new file mode 100644
index 0000000000..61a09232d1
--- /dev/null
+++ b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/FeatureSupplier.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2020 Oracle and/or its affiliates. All rights reserved.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0, which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the
+ * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
+ * version 2 with the GNU Classpath Exception, which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ */
+
+package org.glassfish.jersey.jaxb;
+
+import org.glassfish.jersey.spi.Contract;
+
+import javax.xml.parsers.SAXParserFactory;
+import java.util.Collections;
+import java.util.Map;
+
+/** This supplier is used to set the features on the instances of the supported classes:
+ * <p><ul>
+ *     <li>{@link javax.xml.parsers.SAXParserFactory}</li>
+ *     <li>{@link javax.xml.transform.TransformerFactory}</li>
+ * </ul></p> using one of the methods:
+ * <p><ul>
+ *     <li>{@link javax.xml.parsers.SAXParserFactory#setFeature(String, boolean)}</li>
+ *     <li>{@link javax.xml.transform.TransformerFactory#setFeature(String, boolean)}</li>
+ * </ul></p>
+ *
+ * @since 2.31
+ */
+@Contract
+public interface FeatureSupplier {
+
+    /**
+     * Define whether the feature set is for the instances of the given class.
+     * @param factoryClass the class for which instance the feature set is to be applied.
+     * @return true if this contract implementation is for the given class.
+     */
+    boolean isFor(Class<?> factoryClass);
+
+    /**
+     * The feature set to be applied.
+     * @return the feature set {@code Map} with keys and {@code Boolean} values.
+     */
+    Map<String, Boolean> getFeatures();
+
+    /**
+     * Supply a feature that disables disallow-doctype-decl feature and allows the ENTITY in the xml DOCTYPE.
+     * Registering this feature will override the settings of the secure {@link SAXParserFactory}.
+     * @return A feature that sets {@code http://apache.org/xml/features/disallow-doctype-decl} feature to false.
+     */
+    static FeatureSupplier allowDoctypeDeclFeature() {
+        return new FeatureSupplier() {
+            @Override
+            public boolean isFor(Class<?> factoryClass) {
+                return SAXParserFactory.class == factoryClass;
+            }
+
+            @Override
+            public Map<String, Boolean> getFeatures() {
+                return Collections.singletonMap("http://apache.org/xml/features/disallow-doctype-decl", false);
+            }
+        };
+    }
+}
diff --git a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/PropertySupplier.java b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/PropertySupplier.java
new file mode 100644
index 0000000000..f0e400d152
--- /dev/null
+++ b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/PropertySupplier.java
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2020 Oracle and/or its affiliates. All rights reserved.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0, which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the
+ * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
+ * version 2 with the GNU Classpath Exception, which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ */
+
+package org.glassfish.jersey.jaxb;
+
+import org.glassfish.jersey.spi.Contract;
+
+import java.util.Map;
+
+
+/** This supplier is used to set the properties on the instances of the supported classes:
+ * <p><ul>
+ *     <li>{@link javax.xml.parsers.DocumentBuilderFactory}</li>
+ *     <li>{@link javax.xml.parsers.SAXParser}</li>
+ *     <li>{@link javax.xml.stream.XMLInputFactory}</li>
+ *     <li>{@link javax.xml.transform.TransformerFactory}</li>
+ * </ul></p> using of the methods
+ * <p><ul>
+ *     <li>{@link javax.xml.parsers.DocumentBuilderFactory#setAttribute(String, Object)}</li>
+ *     <li>{@link javax.xml.parsers.SAXParser#setProperty(String, Object)}</li>
+ *     <li>{@link javax.xml.stream.XMLInputFactory#setProperty(String, Object)}</li>
+ *     <li>{@link javax.xml.transform.TransformerFactory#setAttribute(String, Object)}</li>
+ * </ul></p>
+ *
+ * @since 2.31
+ */
+@Contract
+public interface PropertySupplier {
+    /**
+     * Define whether the property set is for the instances of the given class.
+     * @param factoryOrParserClass the class for which instance the property set is to be applied.
+     * @return true if this contract implementation is for given class.
+     */
+    boolean isFor(Class<?> factoryOrParserClass);
+
+    /**
+     * The properties to be applied.
+     * @return the property {@code Map} with keys and {@code Object} values to be applied.
+     */
+    Map<String, Object> getProperties();
+}
diff --git a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/DocumentBuilderFactoryInjectionProvider.java b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/DocumentBuilderFactoryInjectionProvider.java
index 1ebc21cbbd..b5b3ec8f0f 100644
--- a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/DocumentBuilderFactoryInjectionProvider.java
+++ b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/DocumentBuilderFactoryInjectionProvider.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, 2019 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2010, 2020 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -16,6 +16,8 @@
 
 package org.glassfish.jersey.jaxb.internal;
 
+import org.glassfish.jersey.internal.inject.InjectionManager;
+
 import javax.ws.rs.core.Configuration;
 
 import javax.inject.Inject;
@@ -41,9 +43,12 @@ public DocumentBuilderFactoryInjectionProvider(final Configuration config) {
         super(config);
     }
 
+    @Inject
+    private InjectionManager injectionManager;
+
     @Override
     public DocumentBuilderFactory get() {
-        DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
+        final DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
 
         f.setNamespaceAware(true);
 
@@ -51,6 +56,8 @@ public DocumentBuilderFactory get() {
             f.setExpandEntityReferences(false);
         }
 
+        JaxbFeatureUtil.setProperties(injectionManager, DocumentBuilderFactory.class, f::setAttribute);
+
         return f;
     }
 
diff --git a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/JaxbFeatureUtil.java b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/JaxbFeatureUtil.java
new file mode 100644
index 0000000000..3cf9c6eb89
--- /dev/null
+++ b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/JaxbFeatureUtil.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright (c) 2020 Oracle and/or its affiliates. All rights reserved.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0, which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the
+ * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
+ * version 2 with the GNU Classpath Exception, which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ */
+
+package org.glassfish.jersey.jaxb.internal;
+
+import org.glassfish.jersey.internal.inject.InjectionManager;
+import org.glassfish.jersey.internal.inject.Providers;
+import org.glassfish.jersey.jaxb.FeatureSupplier;
+import org.glassfish.jersey.jaxb.PropertySupplier;
+import org.glassfish.jersey.model.internal.RankedComparator;
+
+import java.util.Map;
+import java.util.Optional;
+import java.util.logging.Logger;
+
+/**
+ * Utility class that sets features and properties
+ */
+final class JaxbFeatureUtil {
+
+    private static final Logger LOGGER = Logger.getLogger(JaxbFeatureUtil.class.getName());
+    private static final RankedComparator<PropertySupplier> PROPERTY_COMPARATOR
+            = new RankedComparator<>(RankedComparator.Order.DESCENDING);
+    private static final RankedComparator<FeatureSupplier> FEATURE_COMPARATOR
+            = new RankedComparator<>(RankedComparator.Order.DESCENDING);
+
+    private JaxbFeatureUtil() {
+    }
+
+    static void setFeatures(InjectionManager injectionManager, Class<?> clazz, Settable<Boolean> consumer) {
+        if (injectionManager != null) {
+            final Iterable<FeatureSupplier> featureSuppliers
+                    = Providers.getAllProviders(injectionManager, FeatureSupplier.class, FEATURE_COMPARATOR);
+            for (FeatureSupplier featureSupplier : featureSuppliers) {
+                if (featureSupplier.isFor(clazz)) {
+                    for (Map.Entry<String, Boolean> entry : featureSupplier.getFeatures().entrySet()) {
+                        setFeature(clazz, entry, consumer);
+                    }
+                }
+            }
+        }
+    }
+
+    static void setProperties(InjectionManager injectionManager, Class<?> clazz, Settable<Object> consumer) {
+        if (injectionManager != null) {
+            final Iterable<PropertySupplier> propertySuppliers
+                    = Providers.getAllProviders(injectionManager, PropertySupplier.class, PROPERTY_COMPARATOR);
+            for (PropertySupplier propertySupplier : propertySuppliers) {
+                if (propertySupplier.isFor(clazz)) {
+                    for (Map.Entry<String, Object> entry : propertySupplier.getProperties().entrySet()) {
+                        setProperty(clazz, entry, consumer);
+                    }
+                }
+            }
+        }
+    }
+
+    static <T> void setProperty(Class<?> clazz, Map.Entry<String, T> settable, Settable<T> consumer) {
+        Optional<Exception> exception = consumer.accept(settable.getKey(), settable.getValue());
+        exception.ifPresent((ex) -> LOGGER.warning(LocalizationMessages.CANNOT_SET_PROPERTY(
+                settable.getKey(), settable.getValue(), clazz.getName(), ex)));
+    }
+
+    private static <T> void setFeature(Class<?> clazz, Map.Entry<String, T> settable, Settable<T> consumer) {
+        Optional<Exception> exception = consumer.accept(settable.getKey(), settable.getValue());
+        exception.ifPresent((ex) -> LOGGER.warning(LocalizationMessages.CANNOT_SET_FEATURE(
+                settable.getKey(), settable.getValue(), clazz.getName(), ex)));
+    }
+
+
+    @FunctionalInterface
+    static interface Settable<T> {
+        void set(String key, T t) throws javax.xml.parsers.ParserConfigurationException,
+                org.xml.sax.SAXNotRecognizedException, org.xml.sax.SAXNotSupportedException,
+                javax.xml.transform.TransformerConfigurationException;
+
+        default Optional<Exception> accept(String key, T t) {
+            try {
+                set(key, t);
+                return Optional.empty();
+            } catch (Exception e) {
+                return Optional.of(e);
+            }
+        }
+    }
+}
diff --git a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/SaxParserFactoryInjectionProvider.java b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/SaxParserFactoryInjectionProvider.java
index f004761a73..4b1bbb3a79 100644
--- a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/SaxParserFactoryInjectionProvider.java
+++ b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/SaxParserFactoryInjectionProvider.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, 2019 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2010, 2020 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -16,14 +16,26 @@
 
 package org.glassfish.jersey.jaxb.internal;
 
-import javax.ws.rs.core.Configuration;
+import org.glassfish.jersey.internal.inject.InjectionManager;
+import org.glassfish.jersey.jaxb.FeatureSupplier;
 
 import javax.inject.Inject;
+import javax.ws.rs.core.Configuration;
+import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
+import java.util.LinkedHashMap;
+import java.util.Map;
 
 /**
  * Thread-scoped injection provider of {@link SAXParserFactory SAX parser factories}.
  *
+ * If {@link org.glassfish.jersey.message.MessageProperties#XML_SECURITY_DISABLE} is not set,
+ * the {@link SecureSaxParserFactory} is returned. By default, the {@code http://apache.org/xml/features/disallow-doctype-decl}
+ * feature is set to {@code TRUE}. To override this settings, it is possible to register the
+ * {@link FeatureSupplier#allowDoctypeDeclFeature()}.
+ *
+ * @see FeatureSupplier
+ *
  * @author Paul Sandoz
  * @author Marek Potociar
  * @author Martin Matula
@@ -41,15 +53,21 @@ public SaxParserFactoryInjectionProvider(final Configuration config) {
         super(config);
     }
 
+    @Inject
+    private InjectionManager injectionManager;
+
     @Override
     public SAXParserFactory get() {
-        SAXParserFactory factory = SAXParserFactory.newInstance();
+        final SecureSaxParserFactory factory
+                = new SecureSaxParserFactory(SAXParserFactory.newInstance(), !isXmlSecurityDisabled());
 
         factory.setNamespaceAware(true);
 
-        if (!isXmlSecurityDisabled()) {
-            factory = new SecureSaxParserFactory(factory);
-        }
+        final Map<String, Object> saxParserProperties = new LinkedHashMap<>();
+        JaxbFeatureUtil.setProperties(injectionManager, SAXParser.class, saxParserProperties::put);
+        factory.setSaxParserProperties(saxParserProperties);
+
+        JaxbFeatureUtil.setFeatures(injectionManager, SAXParserFactory.class, factory::setFeature);
 
         return factory;
     }
diff --git a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/SecureSaxParserFactory.java b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/SecureSaxParserFactory.java
index 3cb9397f68..0c5e60cd02 100644
--- a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/SecureSaxParserFactory.java
+++ b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/SecureSaxParserFactory.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2020 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -24,6 +24,7 @@
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
@@ -61,8 +62,11 @@ public InputSource resolveEntity(String publicId, String systemId) {
 
     private static final String EXTERNAL_GENERAL_ENTITIES_FEATURE = "http://xml.org/sax/features/external-general-entities";
     private static final String EXTERNAL_PARAMETER_ENTITIES_FEATURE = "http://xml.org/sax/features/external-parameter-entities";
+    private static final String DISALLOW_DOCTYPE_DECLARATION_FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
 
     private final SAXParserFactory spf;
+    private Map<String, Object> saxParserProperties;
+    private final boolean isSecure;
 
     /**
      * Create new secure SAX parser factory wrapper.
@@ -70,13 +74,25 @@ public InputSource resolveEntity(String publicId, String systemId) {
      * @param spf SAX parser factory.
      */
     public SecureSaxParserFactory(SAXParserFactory spf) {
+        this(spf, true);
+    }
+
+    /**
+     * Create new SAX parser factory wrapper. Can be secure.
+     * @param spf SAX parser factory.
+     * @param isSecure defined whether the parser is secure.
+     */
+    SecureSaxParserFactory(SAXParserFactory spf, boolean isSecure) {
         this.spf = spf;
+        this.isSecure = isSecure;
 
         if (SaxHelper.isXdkParserFactory(spf)) {
             LOGGER.log(Level.WARNING, LocalizationMessages.SAX_XDK_NO_SECURITY_FEATURES());
         } else {
             try {
-                spf.setFeature(EXTERNAL_GENERAL_ENTITIES_FEATURE, Boolean.FALSE);
+                if (isSecure) {
+                    spf.setFeature(EXTERNAL_GENERAL_ENTITIES_FEATURE, Boolean.FALSE);
+                }
             } catch (Exception ex) {
                 LOGGER.log(
                         Level.CONFIG,
@@ -85,7 +101,9 @@ public SecureSaxParserFactory(SAXParserFactory spf) {
             }
 
             try {
-                spf.setFeature(EXTERNAL_PARAMETER_ENTITIES_FEATURE, Boolean.FALSE);
+                if (isSecure) {
+                    spf.setFeature(EXTERNAL_PARAMETER_ENTITIES_FEATURE, Boolean.FALSE);
+                }
             } catch (Exception ex) {
                 LOGGER.log(
                         Level.CONFIG,
@@ -94,13 +112,26 @@ public SecureSaxParserFactory(SAXParserFactory spf) {
             }
 
             try {
-                spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+                if (isSecure) {
+                    spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+                }
             } catch (Exception ex) {
                 LOGGER.log(
                         Level.CONFIG,
                         LocalizationMessages.SAX_CANNOT_ENABLE_SECURE_PROCESSING_FEATURE(spf.getClass()),
                         ex);
             }
+
+            try {
+                if (isSecure) {
+                    spf.setFeature(DISALLOW_DOCTYPE_DECLARATION_FEATURE, Boolean.TRUE);
+                }
+            } catch (Exception ex) {
+                LOGGER.log(
+                        Level.CONFIG,
+                        LocalizationMessages.SAX_CANNOT_ENABLE_DISALLOW_DOCTYPE_DECLARATION_FEATURE(spf.getClass()),
+                        ex);
+            }
         }
     }
 
@@ -146,7 +177,13 @@ public boolean isXIncludeAware() {
 
     @Override
     public SAXParser newSAXParser() throws ParserConfigurationException, SAXException {
-        return new WrappingSAXParser(spf.newSAXParser());
+        final SAXParser wrappingParser = new WrappingSAXParser(spf.newSAXParser(), isSecure);
+        if (saxParserProperties != null) {
+            for (Map.Entry<String, Object> entry : saxParserProperties.entrySet()) {
+                JaxbFeatureUtil.setProperty(SAXParser.class, entry, wrappingParser::setProperty);
+            }
+        }
+        return wrappingParser;
     }
 
     @Override
@@ -160,13 +197,19 @@ public boolean getFeature(String s) throws ParserConfigurationException, SAXNotR
         return spf.getFeature(s);
     }
 
+    void setSaxParserProperties(Map<String, Object> saxParserProperties) {
+        this.saxParserProperties = saxParserProperties;
+    }
+
     @SuppressWarnings("deprecation")
     private static final class WrappingSAXParser extends SAXParser {
 
         private final SAXParser sp;
+        private final boolean isSecure;
 
-        protected WrappingSAXParser(SAXParser sp) {
+        private WrappingSAXParser(SAXParser sp, boolean isSecure) {
             this.sp = sp;
+            this.isSecure = isSecure;
         }
 
         @Override
@@ -240,6 +283,18 @@ public org.xml.sax.Parser getParser() throws SAXException {
         public XMLReader getXMLReader() throws SAXException {
             XMLReader r = sp.getXMLReader();
             r.setEntityResolver(EMPTY_ENTITY_RESOLVER);
+
+            try {
+                if (isSecure) {
+                    r.setFeature(EXTERNAL_GENERAL_ENTITIES_FEATURE, Boolean.FALSE);
+                }
+            } catch (Exception ex) {
+                LOGGER.log(
+                        Level.CONFIG,
+                        LocalizationMessages.SAX_CANNOT_DISABLE_GENERAL_ENTITY_PROCESSING_FEATURE_ON_READER(r.getClass()),
+                        ex);
+            }
+
             return r;
         }
 
diff --git a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/TransformerFactoryInjectionProvider.java b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/TransformerFactoryInjectionProvider.java
index b7e06d6907..fb13b3fe4d 100644
--- a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/TransformerFactoryInjectionProvider.java
+++ b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/TransformerFactoryInjectionProvider.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, 2019 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2010, 2020 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -16,6 +16,8 @@
 
 package org.glassfish.jersey.jaxb.internal;
 
+import org.glassfish.jersey.internal.inject.InjectionManager;
+
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
@@ -47,9 +49,12 @@ public TransformerFactoryInjectionProvider(final Configuration config) {
         super(config);
     }
 
+    @Inject
+    private InjectionManager injectionManager;
+
     @Override
     public TransformerFactory get() {
-        TransformerFactory transformerFactory = TransformerFactory.newInstance();
+        final TransformerFactory transformerFactory = TransformerFactory.newInstance();
 
         if (!isXmlSecurityDisabled()) {
             try {
@@ -59,6 +64,9 @@ public TransformerFactory get() {
             }
         }
 
+        JaxbFeatureUtil.setFeatures(injectionManager, TransformerFactory.class, transformerFactory::setFeature);
+        JaxbFeatureUtil.setProperties(injectionManager, TransformerFactory.class, transformerFactory::setAttribute);
+
         return transformerFactory;
     }
 }
diff --git a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/XmlInputFactoryInjectionProvider.java b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/XmlInputFactoryInjectionProvider.java
index d064d8c7b1..6b8f76e4f8 100644
--- a/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/XmlInputFactoryInjectionProvider.java
+++ b/media/jaxb/src/main/java/org/glassfish/jersey/jaxb/internal/XmlInputFactoryInjectionProvider.java
@@ -16,6 +16,8 @@
 
 package org.glassfish.jersey.jaxb.internal;
 
+import org.glassfish.jersey.internal.inject.InjectionManager;
+
 import javax.ws.rs.core.Configuration;
 
 import javax.inject.Inject;
@@ -40,14 +42,19 @@ public XmlInputFactoryInjectionProvider(final Configuration config) {
         super(config);
     }
 
+    @Inject
+    private InjectionManager injectionManager;
+
     @Override
     public XMLInputFactory get() {
-        XMLInputFactory factory = XMLInputFactory.newInstance();
+        final XMLInputFactory factory = XMLInputFactory.newInstance();
 
         if (!isXmlSecurityDisabled()) {
             factory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE);
         }
 
+        JaxbFeatureUtil.setProperties(injectionManager, XMLInputFactory.class, factory::setProperty);
+
         return factory;
     }
 }
diff --git a/media/jaxb/src/main/resources/org/glassfish/jersey/jaxb/internal/localization.properties b/media/jaxb/src/main/resources/org/glassfish/jersey/jaxb/internal/localization.properties
index 8857093b5a..f5886e535a 100644
--- a/media/jaxb/src/main/resources/org/glassfish/jersey/jaxb/internal/localization.properties
+++ b/media/jaxb/src/main/resources/org/glassfish/jersey/jaxb/internal/localization.properties
@@ -17,10 +17,16 @@
 error.unmarshalling.jaxb=Error un-marshalling JAXB object of type: {0}.
 error.reading.entity.missing=Missing entity.
 no.param.constructor.missing=No-param constructor not found in the class [{0}].
+cannot.set.property=Cannot set property "{0}"="{1}" on instance of {2}, {3}.
+cannot.set.feature=Cannot set feature "{0}"="{1}" on instance of {2}, {3}.
 sax.cannot.enable.secure.processing.feature=JAXP feature XMLConstants.FEATURE_SECURE_PROCESSING cannot be set \
   on a SAX parser factory [{0}].
+sax.cannot.enable.disallow.doctype.declaration.feature=Cannot enable feature that disallows doctype declaration \
+  on SAX parser factory [{0}].
 sax.cannot.disable.general.entity.processing.feature= Cannot disable external general entity processing feature \
   on SAX parser factory [{0}].
+sax.cannot.disable.general.entity.processing.feature.on.reader=Cannot disable external general entity processing feature \
+  on XML reader [{0}].
 sax.cannot.disable.parameter.entity.processing.feature= Cannot disable external parameter entity processing feature \
   on SAX parser factory [{0}].
 sax.xdk.no.security.features=Using XDK. No security features will be enabled for the SAX parser.
diff --git a/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/FeatureAndPropertySupplierTest.java b/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/FeatureAndPropertySupplierTest.java
new file mode 100644
index 0000000000..bc28e3a7d0
--- /dev/null
+++ b/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/FeatureAndPropertySupplierTest.java
@@ -0,0 +1,239 @@
+/*
+ * Copyright (c) 2020 Oracle and/or its affiliates. All rights reserved.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0, which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the
+ * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
+ * version 2 with the GNU Classpath Exception, which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ */
+
+package org.glassfish.jersey.jaxb.internal;
+
+import org.glassfish.jersey.internal.inject.AbstractBinder;
+import org.glassfish.jersey.internal.inject.InjectionManager;
+import org.glassfish.jersey.internal.inject.PerThread;
+import org.glassfish.jersey.jaxb.FeatureSupplier;
+import org.glassfish.jersey.jaxb.PropertySupplier;
+import org.glassfish.jersey.message.MessageProperties;
+import org.hamcrest.CoreMatchers;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXParseException;
+
+import javax.inject.Singleton;
+import javax.ws.rs.Priorities;
+import javax.ws.rs.core.Configuration;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.transform.TransformerFactory;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.PrintStream;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+import java.util.Collections;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.logging.LogManager;
+
+public class FeatureAndPropertySupplierTest {
+    private InjectionManager injectionManager;
+    private static PrintStream systemErrorStream;
+    private static ByteArrayOutputStream errorStream = new ByteArrayOutputStream();
+
+    @BeforeClass
+    public static void setup() {
+        systemErrorStream = System.err;
+        System.setErr(new PrintStream(errorStream));
+    }
+
+    @AfterClass
+    public static void tearDown() {
+        System.setErr(systemErrorStream);
+    }
+
+    @Test
+    public void xmlReaderDoesNotAllowDocTypeDecl() throws Exception {
+        injectionManager = SaxParserFactoryInjectionProviderTest.createInjectionManager(new AbstractBinder() {
+            @Override
+            protected void configure() {
+                bind(createFeatureSupplier(SAXParserFactory.class,
+                        "http://apache.org/xml/features/disallow-doctype-decl", true))
+                        .to(FeatureSupplier.class)
+                        .ranked(Priorities.USER - 1); //override the SaxParserFactoryInjectionProviderTest.AllowDoctypeDeclFeature
+            }
+        });
+
+        String url = "file:///no-such-file";
+        String content = "<!DOCTYPE x [<!ENTITY % pe SYSTEM '" + url + "'> %pe;]><x/>";
+
+        try {
+            injectionManager.getInstance(SAXParserFactory.class).newSAXParser().getXMLReader()
+                    .parse(new InputSource(new ByteArrayInputStream(content.getBytes("us-ascii"))));
+            Assert.fail("DOCTYPE is NOT disallowed when the feature \"disallow-doctype-decl\" is true");
+        } catch (SAXParseException saxe) {
+            //expected
+        }
+
+    }
+
+    @Test
+    public void setPropertyOnSaxParserIsNotRecognised() throws ParserConfigurationException, SAXException {
+        injectionManager = SaxParserFactoryInjectionProviderTest.createInjectionManager(new AbstractBinder() {
+            @Override
+            protected void configure() {
+                bind(createPropertySupplier(SAXParser.class, "Unknown-Property", "Unknown Value")).to(PropertySupplier.class);
+            }
+        });
+
+
+        injectionManager.getInstance(SAXParserFactory.class).newSAXParser();
+        String warning = new String(errorStream.toByteArray());
+        errorStream.reset();
+        Assert.assertThat(warning, CoreMatchers.containsString("Cannot set property \"Unknown-Property\""));
+    }
+
+    @Test
+    public void setPropertyOnInsecureSaxParserIsNotRecognised() throws ParserConfigurationException, SAXException {
+        final AtomicReference<Configuration> defaultConfig = new AtomicReference<>(null);
+        InvocationHandler handler = (proxy, method, args) -> {
+            if (method.getName().equals("getProperty") && args[0].equals(MessageProperties.XML_SECURITY_DISABLE)) {
+                return true;
+            }
+            return method.invoke(defaultConfig.get(), args);
+        };
+        Configuration insecureConfig =
+                (Configuration) Proxy.newProxyInstance(getClass().getClassLoader(), new Class[]{Configuration.class}, handler);
+        injectionManager = SaxParserFactoryInjectionProviderTest.createInjectionManager(new AbstractBinder() {
+            @Override
+            protected void configure() {
+                bind(createPropertySupplier(SAXParser.class, "Unknown-Property", "Unknown Value")).to(PropertySupplier.class);
+                bindFactory(() -> insecureConfig).to(Configuration.class).ranked(Priorities.USER - 1);
+            }
+        });
+
+        defaultConfig.set(injectionManager.getInstance(Configuration.class));
+
+        injectionManager.getInstance(SAXParserFactory.class).newSAXParser();
+        String warning = new String(errorStream.toByteArray());
+        errorStream.reset();
+        Assert.assertThat(warning, CoreMatchers.containsString("Cannot set property \"Unknown-Property\""));
+    }
+
+    @Test
+    public void setPropertyOnTransformerFactoryIsNotRecognised() {
+        injectionManager = SaxParserFactoryInjectionProviderTest.createInjectionManager(new AbstractBinder() {
+            @Override
+            protected void configure() {
+                bind(createPropertySupplier(TransformerFactory.class, "Unknown-Property", "Unknown Value"))
+                        .to(PropertySupplier.class);
+                bindFactory(TransformerFactoryInjectionProvider.class, Singleton.class)
+                        .to(TransformerFactory.class).in(PerThread.class);
+            }
+        });
+
+        injectionManager.getInstance(TransformerFactory.class);
+        LogManager.getLogManager().reset();
+        String warning = new String(errorStream.toByteArray());
+        errorStream.reset();
+        Assert.assertThat(warning, CoreMatchers.containsString("Cannot set property \"Unknown-Property\""));
+    }
+
+    @Test
+    public void setFeatureOnTransformerFactoryIsNotRecognised() {
+        injectionManager = SaxParserFactoryInjectionProviderTest.createInjectionManager(new AbstractBinder() {
+            @Override
+            protected void configure() {
+                bind(createFeatureSupplier(TransformerFactory.class, "Unknown-Feature", true))
+                        .to(FeatureSupplier.class);
+                bindFactory(TransformerFactoryInjectionProvider.class, Singleton.class)
+                        .to(TransformerFactory.class).in(PerThread.class);
+            }
+        });
+
+        injectionManager.getInstance(TransformerFactory.class);
+        String warning = new String(errorStream.toByteArray());
+        errorStream.reset();
+        Assert.assertThat(warning, CoreMatchers.containsString("Cannot set feature \"Unknown-Feature\""));
+    }
+
+    @Test
+    public void setPropertyOnXmlInputStreamIsNotRecognised() {
+        injectionManager = SaxParserFactoryInjectionProviderTest.createInjectionManager(new AbstractBinder() {
+            @Override
+            protected void configure() {
+                bind(createPropertySupplier(XMLInputFactory.class, "Unknown-Property", "Unknown Value"))
+                        .to(PropertySupplier.class);
+                bindFactory(XmlInputFactoryInjectionProvider.class, Singleton.class)
+                        .to(XMLInputFactory.class).in(PerThread.class);
+            }
+        });
+
+        injectionManager.getInstance(XMLInputFactory.class);
+        String warning = new String(errorStream.toByteArray());
+        errorStream.reset();
+        Assert.assertThat(warning, CoreMatchers.containsString("Cannot set property \"Unknown-Property\""));
+    }
+
+    @Test
+    public void setPropertyOnDocumentBuilderFactoryIsNotRecognised() {
+        injectionManager = SaxParserFactoryInjectionProviderTest.createInjectionManager(new AbstractBinder() {
+            @Override
+            protected void configure() {
+                bind(createPropertySupplier(DocumentBuilderFactory.class, "Unknown-Property", "Unknown Value"))
+                        .to(PropertySupplier.class);
+                bindFactory(DocumentBuilderFactoryInjectionProvider.class, Singleton.class)
+                        .to(DocumentBuilderFactory.class).in(PerThread.class);
+            }
+        });
+
+        injectionManager.getInstance(DocumentBuilderFactory.class);
+        String warning = new String(errorStream.toByteArray());
+        errorStream.reset();
+        Assert.assertThat(warning, CoreMatchers.containsString("Cannot set property \"Unknown-Property\""));
+
+    }
+
+    private static PropertySupplier createPropertySupplier(Class<?> clazz, String key, Object value) {
+        return new PropertySupplier() {
+            @Override
+            public boolean isFor(Class<?> factoryOrParserClass) {
+                return clazz == factoryOrParserClass;
+            }
+
+            @Override
+            public Map<String, Object> getProperties() {
+                return Collections.singletonMap(key, value);
+            }
+        };
+    }
+
+    private static FeatureSupplier createFeatureSupplier(Class<?> clazz, String key, Boolean value) {
+        return new FeatureSupplier() {
+            @Override
+            public boolean isFor(Class<?> factoryOrParserClass) {
+                return clazz == factoryOrParserClass;
+            }
+
+            @Override
+            public Map<String, Boolean> getFeatures() {
+                return Collections.singletonMap(key, value);
+            }
+        };
+    }
+}
diff --git a/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/JaxbStringReaderProviderTest.java b/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/JaxbStringReaderProviderTest.java
index c92c71857f..d906232044 100644
--- a/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/JaxbStringReaderProviderTest.java
+++ b/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/JaxbStringReaderProviderTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2020 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -22,6 +22,7 @@
 
 import java.lang.annotation.Annotation;
 import java.lang.reflect.Type;
+import java.util.Map;
 
 import javax.ws.rs.RuntimeType;
 import javax.ws.rs.core.MediaType;
@@ -35,6 +36,7 @@
 import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.parsers.SAXParserFactory;
 
+import org.glassfish.jersey.jaxb.FeatureSupplier;
 import org.glassfish.jersey.model.internal.CommonConfig;
 import org.glassfish.jersey.model.internal.ComponentBag;
 
@@ -51,7 +53,13 @@ public void stringReaderDoesNotReadExternalDtds() {
 
             @Override
             public SAXParserFactory get() {
-                return spf.get();
+                SAXParserFactory factory = spf.get();
+
+                for (Map.Entry<String, Boolean> entry : FeatureSupplier.allowDoctypeDeclFeature().getFeatures().entrySet()){
+                    JaxbFeatureUtil.setProperty(SAXParserFactory.class, entry, factory::setFeature);
+                }
+
+                return factory;
             }
         };
 
diff --git a/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/SaxParserFactoryInjectionProviderTest.java b/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/SaxParserFactoryInjectionProviderTest.java
index 5c30ccd778..5a79737e04 100644
--- a/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/SaxParserFactoryInjectionProviderTest.java
+++ b/media/jaxb/src/test/java/org/glassfish/jersey/jaxb/internal/SaxParserFactoryInjectionProviderTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2020 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -41,10 +41,12 @@
 import org.glassfish.jersey.internal.inject.InjectionManager;
 import org.glassfish.jersey.internal.inject.Injections;
 import org.glassfish.jersey.internal.inject.PerThread;
+import org.glassfish.jersey.jaxb.FeatureSupplier;
 
 import org.junit.Before;
 import org.junit.Test;
 import org.xml.sax.InputSource;
+
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNotSame;
 import static org.junit.Assert.assertSame;
@@ -133,6 +135,7 @@ protected void configure() {
                         .to(SAXParserFactory.class)
                         .in(PerThread.class);
                 bindAsContract(MySPFProvider.class).in(Singleton.class);
+                bind(FeatureSupplier.allowDoctypeDeclFeature()).to(FeatureSupplier.class);
             }
         };
         System.arraycopy(customBinders, 0, binders, 2, customBinders.length);
diff --git a/pom.xml b/pom.xml
index e0ed6b5624..b222100af6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -2153,8 +2153,8 @@
         <javax.interceptor.version>1.2.5</javax.interceptor.version>
         <javax.persistence.version>2.2.3</javax.persistence.version>
         <javax.validation.api.version>2.0.2</javax.validation.api.version>
-        <jaxb.api.version>2.3.2</jaxb.api.version>
-        <jaxb.ri.version>2.3.2</jaxb.ri.version>
+        <jaxb.api.version>2.3.3</jaxb.api.version>
+        <jaxb.ri.version>2.3.3</jaxb.ri.version>
         <jaxrs.api.spec.version>2.1</jaxrs.api.spec.version>
         <jaxrs.api.impl.version>2.1.6</jaxrs.api.impl.version>
         <jetty.plugin.version>6.1.26</jetty.plugin.version>
diff --git a/tests/e2e-entity/src/test/java/org/glassfish/jersey/tests/e2e/entity/XXETest.java b/tests/e2e-entity/src/test/java/org/glassfish/jersey/tests/e2e/entity/XXETest.java
index 8e3d3b33e5..4b9aff2458 100644
--- a/tests/e2e-entity/src/test/java/org/glassfish/jersey/tests/e2e/entity/XXETest.java
+++ b/tests/e2e-entity/src/test/java/org/glassfish/jersey/tests/e2e/entity/XXETest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2020 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -35,6 +35,7 @@
 import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stream.StreamSource;
 
+import org.glassfish.jersey.jaxb.FeatureSupplier;
 import org.glassfish.jersey.server.ResourceConfig;
 import org.glassfish.jersey.test.JerseyTest;
 
@@ -118,7 +119,7 @@ public StreamSource postStream(final StreamSource s) {
 
     @Override
     public ResourceConfig configure() {
-        return new ResourceConfig(EntityHolderResource.class);
+        return new ResourceConfig(EntityHolderResource.class).register(FeatureSupplier.allowDoctypeDeclFeature());
     }
 
     @Test
@@ -200,6 +201,6 @@ public void testStreamSecure() {
 
     // NOTE - this is a tes migrated from Jersey 1.x tests. The original test class contains also insecure "versions" of the
     // methods above configured via FeaturesAndProperties.FEATURE_DISABLE_XML_SECURITY. Those methods are ommited,
-    // as Jersey 2 does not support such consturct.
+    // as Jersey 2 does not support such construct.
 
 }