CVE-2026-12975
published 2026-06-25CVE-2026-12975: A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or…
PriorityP353high8.5CVSS 3.1
AVNACLPRLUINSCCLINAH
EPSS
0.44%
36.9th percentile
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apicurio | apicurio-registry-rhel8 | — | — |
| apicurio | apicurio-registry-rhel9 | — | — |
| redhat | build_of_apicurio_registry | 3.0 – 3.2 | — |
CVSS provenance
nvdv3.18.5HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
vendor_redhat8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in Apicurio Registry.
ghsa_unreviewed·2026-06-26
CVE-2026-12975 [HIGH] CWE-611 A flaw was found in Apicurio Registry.
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Red Hat
Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS
vendor_redhat·2026-06-10·CVSS 8.5
CVE-2026-12975 [HIGH] CWE-611 Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS
Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Package: apicurio/apicurio-registry-rhel8 (Red Hat build of Apicurio Registry 3) - Affected
Package: apicurio/apicurio-registry-rhel9 (Red Hat build of Apicurio Registry 3) - Affecte
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2026:59360https://access.redhat.com/security/cve/CVE-2026-12975https://bugzilla.redhat.com/show_bug.cgi?id=2491688https://access.redhat.com/errata/RHSA-2026:59360https://access.redhat.com/security/cve/CVE-2026-12975https://bugzilla.redhat.com/show_bug.cgi?id=2491688https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json
2026-06-25
Published