Skip to content
fr Sign in
Not rated

CVE-2026-102496 Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a…

Description

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Affected products and versions

Product Affected versions Fixed in
Apache XMLSchema 2.3 earliest → < 2.3.3 2.3.3

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache XMLSchema

The 3 CVEs of Apache XMLSchema →
CVE-2026-102497 The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model… Not rated CVE-2026-102495 Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make… Not rated
Track this CVE