Apache Software Foundation Apache Xmlschema vulnerabilities

CVE-2026-102497 [HIGH] CWE-674 CVE-2026-102497: The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitutio The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

CVE-2026-102496 [HIGH] CWE-674 CVE-2026-102496: Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

CVE-2026-102495 [HIGH] CWE-674 CVE-2026-102495: Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.