IO.APICURIO:APICURIO-REGISTRY-SCHEMA-UTIL-XML · CVE-2026-12993 · Package
FIX → 3.3.1 · 3.2.6
Apicurio Registry's XML schema parser does not disable DOCTYPE declarations or secure processing, so crafted nested-entity XML can consume large amounts of CPU and heap. An attacker with artifact-write permission can make the registry slow or crash, though the JAXP default entity-expansion limit partly mitigates it.
first public Jun 26, 2026 · 2 sources
Running Io.apicurio:apicurio-registry-schema-util-xml? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Exposure requires the Apicurio Registry XML schema utility on the processing path and an account with artifact-write permission that can upload XML documents. Deployments where only trusted users can write artifacts, or that do not use the XML schema utility, are less exposed.
Not affected if no-xml-artifacts, read-only-access
Who cares apicurio-registry, cwe-776, java, maven, schema-registry
io.apicurio:apicurio-registry-schema-util-xml in your build files (for example mvn dependency:list or your lockfile) and compare it to the fixed versions below.A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.
Upgrade to 3.3.1 · 3.2.6
io.apicurio:apicurio-registry-schema-util-xml 3.3.x: move to 3.3.1io.apicurio:apicurio-registry-schema-util-xml 3.2.x: move to 3.2.6This page as .md · .json · in your agent: get_signal("CVE-2026-12993") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.