Vulnerability · Published Jun 25, 2026 · Assigned by redhat

CVE-2026-12993Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset

Medium 6.5

In plain English

A medium-severity security flaw in Red Hat build of Apicurio Registry 3.3.1 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 55.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.apicurio:apicurio-registry-schema-util-xml	3.3.1	GHSA-748j-wm96-4wh5
Maven	io.apicurio:apicurio-registry-schema-util-xml	3.2.6	GHSA-748j-wm96-4wh5

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat build of Apicurio Registry 3.3.1	see references
Red Hat	Red Hat build of Apicurio Registry 3.3.1	see references

Weakness: CWE-776 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

RHSA-2026:59360 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-12993 vdb-entry, x_refsource_REDHAT
RHBZ#2491692 issue-tracking, x_refsource_REDHAT