CVE-2026-102497

A low impact denial-of-service flaw was found in Apache XMLSchema. The Apache XmlSchema walker (xmlschema-walker) does not detect cycles in type derivations, substitution groups, model groups, or attribute groups. An attacker who can supply a specially crafted XML schema containing such cyclic definitions to an application that accepts and walks untrusted XML schemas can cause unbounded recursion that exhausts the call stack, resulting in a StackOverflowError that terminates the processing thread or crashes the application, causing a denial of service. Confidentiality and integrity are not affected. Red Hat rates this flaw LOW severity because exploitation requires the uncommon configuration in which an application processes untrusted, user-supplied XML schema definitions, and the resulting stack overflow typically affects only the availability of the request thread rather than the entire process. This differs from the CISA rating of 7.5 (IMPORTANT), which assumes low attack complexity and high availability impact. No Red Hat products are currently listed as affected by this flaw; the vulnerable component is the upstream Maven artifact org.apache.ws.xmlschema/xmlschema-walker.