8.5
Élevée
CVE-2026-12975 A flaw was found in Apicurio Registry
Description
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat build of Apicurio Registry 3 | Versions non publiées | |
| Red Hat build of Apicurio Registry 3.3.1 | Versions non publiées |
Références
- RHSA-2026:59360 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2491688 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat build of Apicurio Registry 3
Les 78 CVE de Red Hat build of Apicurio Registry 3 →
CVE-2026-107912
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
7.7
Élevée
CVE-2026-120971
A flaw was found in RESTEasy's default exception mapper
5.3
Moyenne
CVE-2026-94449
Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service
7.5
Élevée
CVE-2026-93562
Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
6.5
Moyenne