CVE-2026-12993
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in Apicurio Registry occurs because DocumentBuilderAccessor does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING, although it blocks external DTD and schema access. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant), causing CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.
Risk Assessment
The risk is a denial-of-service (DoS) attack via XML Entity Expansion (billion-laughs), exhausting CPU and memory resources. While it requires artifact-write permissions, a compromised account could lead to significant service disruption.
Recommendation
Update Apicurio Registry to a version that disables DOCTYPE declarations and enables FEATURE_SECURE_PROCESSING in DocumentBuilderAccessor. Until then, restrict artifact-write permissions and monitor CPU/memory usage for anomalies.
Other vulnerabilities in Apicurio Registry
See all- CVE-2026-12992High
A Server-Side Request Forgery (SSRF) vulnerability was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs.
- CVE-2026-12975High
A flaw was found in Apicurio Registry where the ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind SSRF via external DTD/entity fetch, or cause denial of service via entity expansion.
Original NVD description (English source)
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.