CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures
Apache XMLSchema before 2.3.3 allows denial of service via deeply nested schemas that overflow the stack.
21
Vulnerability3 · 1 read
CVE-2026-102496
Stack overflow DoS in Apache XmlSchema via nested schemas
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache XmlSchema does not limit how deeply schema structures may be nested while it builds its schema model. A malicious XML schema can force that parsing to recurse until the process stack overflows, which crashes the parser and causes a denial of service. The impact is loss of availability for any application that parses the crafted schema; no other impact is described. Applications using Apache XmlSchema versions before 2.3.3 are affected. There is no known public proof of concept and the issue is not in CISA KEV.
What to do: Upgrade Apache XmlSchema to version 2.3.3 or later and redeploy every application that bundles it, including transitive dependencies. Until then, do not parse XML schemas from untrusted sources.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache XmlSchema | versions prior to 2.3.3 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.