Aller au contenu
Se connecter
Non notée

CVE-2026-102497 The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model…

Description

The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache XMLSchema 2.3 premières → < 2.3.3 2.3.3

Autres CVE de Apache XMLSchema

Les 3 CVE de Apache XMLSchema →
CVE-2026-102496 Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a… Non notée CVE-2026-102495 Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make… Non notée
Suivre cette CVE