CVE-2026-102496
UnknownSummary
Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3.
Risk Assessment
An attacker could exploit this vulnerability to cause a denial of service, potentially disrupting applications using Apache XmlSchema.
Recommendation
Upgrade Apache XmlSchema to version 2.3.3, which fixes the issue.
Other vulnerabilities in Apache XmlSchema
See all- CVE-2026-102497Unknown
The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3.
- CVE-2026-102495Unknown
Apache XmlSchema does not limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. The issue is fixed in version 2.3.3.
Original NVD description (English source)
Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS