diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index 5dfca2f0..3f9c4ab4 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -301,6 +301,9 @@
 
     <!-- *** Parent beans for ukf-mda. *** -->
 
+    <bean id="CRDetectionStage" abstract="true" parent="stage_parent"
+        class="uk.org.ukfederation.mda.dom.CRDetectionStage"/>
+
     <bean id="EntityAttributeAddingStage" abstract="true" parent="stage_parent"
         class="uk.org.ukfederation.mda.dom.saml.mdattr.EntityAttributeAddingStage"/>
 
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 785c9cd3..49d15315 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -323,6 +323,14 @@
         *********************
     -->
     
+    <!--
+        check_cr
+        
+        Check for the presence of CR characters in text content or attribute values.
+        This protects against SSPCPP-684 in the Shibboleth SP.
+    -->
+    <bean id="check_cr" parent="CRDetectionStage"/>
+
     <!--
         check_misc
     -->
@@ -563,6 +571,7 @@
                 <ref bean="check_adfs"/>
                 <ref bean="check_algsupport"/>
                 <ref bean="check_bindings"/>
+                <ref bean="check_cr"/>
                 <ref bean="check_hoksso"/>
                 <ref bean="check_idpdisc"/>
                 <ref bean="check_incmd"/>
diff --git a/tools/ukf-mda/ukf-mda-0.9.0.jar b/tools/ukf-mda/ukf-mda-0.9.1.jar
similarity index 79%
rename from tools/ukf-mda/ukf-mda-0.9.0.jar
rename to tools/ukf-mda/ukf-mda-0.9.1.jar
index a95ebdf5..39e622c7 100644
Binary files a/tools/ukf-mda/ukf-mda-0.9.0.jar and b/tools/ukf-mda/ukf-mda-0.9.1.jar differ