Log in Start free

Vulnerability · Published Jun 25, 2026 · Assigned by redhat

CVE-2026-12975Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos

High 8.5

In plain English

A high-severity XML external entity in Red Hat build of Apicurio Registry 3.3.1 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.4%top 61.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.apicurio:apicurio-registry-schema-util-common3.3.1GHSA-7g64-f2hm-vjxp
Mavenio.apicurio:apicurio-registry-schema-util-common3.2.6GHSA-7g64-f2hm-vjxp

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Apicurio Registry 3.3.1 see references
Red Hat Red Hat build of Apicurio Registry 3.3.1 see references

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H

References