用apache标准taglibs替换jstl-1.1.2时，org.apache.taglibs.standard.util.XmlUtil上的java.lang.NoClassDefFoundError

由于XML标记漏洞，我不得不替换jstl jar。当我用apache标准taglib更新jstl时。我在访问JSP时出错

现有依赖项：

<dependency>
    <groupId>javax.servlet</groupId>
    <artifactId>jstl</artifactId>
    <version>1.1.2</version>
</dependency>

有人能提出这里的问题吗

<dependency>
    <groupId>org.apache.taglibs</groupId>
    <artifactId>taglibs-standard-spec</artifactId>
    <version> 1.2.5</version>
</dependency>

<dependency>
    <groupId>org.apache.taglibs</groupId>
    <artifactId>taglibs-standard-impl</artifactId>
    <version> 1.2.5</version>
</dependency>

SEVERE [http-nio-8080-exec-67] org.apache.catalina.core.ApplicationDispatcher.invoke Servlet.service() for servlet [jsp] threw exception
    java.lang.NoClassDefFoundError: Could not initialize class org.apache.taglibs.standard.util.XmlUtil
        at org.apache.taglibs.standard.tlv.JstlBaseTLV.validate(JstlBaseTLV.java:154)
        at org.apache.taglibs.standard.tlv.JstlFmtTLV.validate(JstlFmtTLV.java:97)