GHSA-748j-wm96-4wh5

    Dashboard / Vulnerabilities / GHSA-748j-wm96-4wh5

    GHSA-748j-wm96-4wh5

    Published: 26 Jun 2026Last Modified: 4 Nov 2026

    Summary: Apicurio Registry is vulnerable to denial of service through XML entity expansion

    Details: A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.

    References: https://nvd.nist.gov/vuln/detail/CVE-2026-12993, https://github.com/Apicurio/apicurio-registry/issues/8189, https://github.com/Apicurio/apicurio-registry/pull/8200, https://github.com/Apicurio/apicurio-registry/commit/03cd1cc081d9b1b4c8b9a59330ff4c980dc68b73, https://github.com/Apicurio/apicurio-registry/commit/48369d0e9008f7aab16dce5970c1ecbdd55e9aa5, https://access.redhat.com/errata/RHSA-2026:59360, https://access.redhat.com/security/cve/CVE-2026-12993, https://bugzilla.redhat.com/show_bug.cgi?id=2491692, https://github.com/Apicurio/apicurio-registry/releases/tag/3.3.1, https://github.com/Apicurio/apicurio-registry/releases/tag/v3.2.6, https://github.com/apicurio/apicurio-registry

    Affected packages

    Package

    Name: io.apicurio:apicurio-registry-schema-util-xml

    Purl: pkg:maven/io.apicurio/apicurio-registry-schema-util-xml

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 3.3.0
    Fixed -3.3.1

    Affected versions

    3.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-748j-wm96-4wh5 | CVE-DB