Read the docs
TI-2026-11055 Aliases CVE-2026-12993GHSA-748j-wm96-4wh5

Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset

Priority LOW 29CWE-776Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00519 44th percentileScored 2026-11-07
Fix Fixed io.apicurio:apicurio-registry-schema-util-xml (Maven): 3.3.1, 3.2.6Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Apicurio Registry 3.3.1——Not affectedCNA
Red HatRed Hat build of Apicurio Registry 3.3.1——Not affectedCNA
—io.apicurio:apicurio-registry-schema-util-xml (Maven)3.3.0 to before 3.3.13.3.1Patch availableGHSA-748j-wm96-4wh5
—io.apicurio:apicurio-registry-schema-util-xml (Maven)before 3.2.63.2.6Patch availableGHSA-748j-wm96-4wh5
  • Red Hat build of Apicurio Registry 3.3.1 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Apicurio Registry 3.3.1 VendorRed Hat Affected — Fixed in — Not affected CNA
  • io.apicurio:apicurio-registry-schema-util-xml (Maven) Vendor— Affected 3.3.0 to before 3.3.1 Fixed in 3.3.1 Patch available GHSA-748j-wm96-4wh5
  • io.apicurio:apicurio-registry-schema-util-xml (Maven) Vendor— Affected before 3.2.6 Fixed in 3.2.6 Patch available GHSA-748j-wm96-4wh5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:*3.0 – 3.2VulnerableRed Hat
  • cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:* Versions 3.0 – 3.2 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-748j-wm96-4wh5 io.apicurio:apicurio-registry-schema-util-xml (Maven) Fixed in 3.3.1 Advisory →
  • Fix · GHSA-748j-wm96-4wh5 io.apicurio:apicurio-registry-schema-util-xml (Maven) Fixed in 3.2.6 Advisory →

Red Hat 1 advisory

  • RHSA-2026:59360 Released 2026-08-25 · Red Hat rating Important
    Apicurio Registry (container images) release and security update [ 3.3.1 GA ]
    • Red Hat build of Apicurio Registry 3.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat build of Apicurio Registry 3.3.1 — RHSA-2026:59360

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-11039 XML external entity injection in Red Hat build of Apicurio Registry 3.3.1Priority LOW 37
    • TI-2026-11054 Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validationPriority LOW 32
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apicurio Registry 3.3.1Fixed RHSA-2026:59360

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12993
  2. 2026-10-03 Alias added: GHSA-748j-wm96-4wh5
  3. 2026-10-09 Fix available: RHSA-2026:59360 · Red Hat
  4. 2026-10-20 Fix available: Red Hat build of Apicurio Registry 3.3.1 · Red Hat
  5. 2026-11-04 Fix available: Maven/io.apicurio:[email protected], Maven/io.apicurio:[email protected] · GHSA-748j-wm96-4wh5
  6. 2026-11-04 CVSS score added · GHSA-748j-wm96-4wh5
  7. 2026-11-04 Weakness changed · GHSA-748j-wm96-4wh5
  8. 2026-11-04 11 new references · GHSA-748j-wm96-4wh5

References

Advisory 4

Other 7

  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2026-11039 XML external entity injection in Red Hat build of Apicurio Registry 3.3.1 CVSS 3.1HIGH 8.5
  • TI-2026-11054 Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences