I found us having to workaround this one:

        // This is to disable DTD lookups on the internet
        DocumentBuilderFactory dbf = XMLUnit.getControlDocumentBuilderFactory();
        dbf.setFeature("http://xml.org/sax/features/validation", false);
        dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-dtd-grammar", false);
        dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

I think that by default, at least loading external DTDs should be disabled, since I prefer to have my tests reliably pass without external factors being able to trigger failures. (I don't particularly mind validation being left turned on for DTDs which are local... and am not entirely sure why we are disabling that as well.)