Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-29T11:33:51 org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

A flaw was found in Apache XMLSchema. The parser does not properly restrict how deeply schema imports and includes can be nested during processing. A remote attacker could provide a crafted schema with deeply nested references, triggering unbounded recursion that exhausts the call stack. This flaw leads to an application crash, resulting in a Denial of Service (DoS).

This flaw is rated as having an Important severity because unauthenticated remote attackers can crash application runtimes by submitting crafted definitions to services parsing untrusted XML schemas. In environments such as Red Hat JBoss Fuse or Enterprise Application Platform, services that dynamically resolve nested schema dependencies can experience JVM stack exhaustion and complete denial of service. The blast radius is limited to service availability, as the issue does not permit remote code execution or unauthorized data exposure. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat build of Apache Camel 4 for Quarkus 3 Affected xmlschema-core Red Hat build of Apache Camel for Spring Boot 4 Affected xmlschema-core Red Hat Fuse 7 Not affected xmlschema-core Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix xmlschema-core Red Hat JBoss Enterprise Application Platform 8 Affected xmlschema-core Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected xmlschema-core Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th-torch-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th-torch-cuda-py312-rhel9 Red Hat Single Sign-On 7 Will not fix xmlschema-core https://www.cve.org/CVERecord?id=CVE-2026-102495 https://nvd.nist.gov/vuln/detail/CVE-2026-102495 https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6s