CVE-2026-102495

Apache XmlSchema does not limit how deeply schema import and include directives can be nested. A malicious schema can force the parser to recurse until the call stack overflows, crashing the process and causing a denial of service. An attacker who can supply a schema for parsing gains availability impact only; this is not described as code execution or data theft. Any application that parses schemas with a vulnerable XmlSchema release is affected, including software that pulls the library in transitively. There is no known public proof-of-concept and no report of exploitation in the wild; the issue is not listed in CISA KEV and has not yet been scored.

What to do: Upgrade Apache XmlSchema to 2.3.3 or later and rebuild or redeploy applications that bundle it. Treat untrusted XML schemas as untrusted input and avoid parsing them until the fixed library is in place. Review dependency trees (including transitive use via SOAP, CXF, or other schema tooling) for older XmlSchema jars.