IO.APICURIO:APICURIO-REGISTRY-SCHEMA-UTIL-COMMON · CVE-2026-12975 · Package
FIX → 3.3.1 · 3.2.6
Apicurio Registry's XML content-type check parses uploaded documents without disabling external entity resolution. An attacker can upload a crafted XML file to make the server fetch an external address (blind SSRF) or exhaust resources through entity expansion.
first public Jun 25, 2026 · 2 sources
Running Io.apicurio:apicurio-registry-schema-util-common? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams that embed or run Apicurio Registry's schema utilities, especially where XML artifacts can be uploaded to a registry running with default configuration. An attacker with artifact-write permission, or unauthenticated access when the registry uses default settings, can trigger the flaw. Deployments that do not accept XML uploads or that restrict artifact writes to trusted users are at lower risk.
Not affected if auth-required, xml-uploads-disabled
Who cares apicurio, cwe-611, java, maven, schema-registry
io.apicurio:apicurio-registry-schema-util-common in your build file or dependency tree against the affected ranges.A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Upgrade to 3.3.1 · 3.2.6
io.apicurio:apicurio-registry-schema-util-common 3.3.x: move to 3.3.1io.apicurio:apicurio-registry-schema-util-common 3.2.x and earlier: move to 3.2.6This page as .md · .json · in your agent: get_signal("CVE-2026-12975") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.