CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
Apache XMLSchema before 2.3.3 can crash when cyclic schema definitions overflow the schema walker.
22
Vulnerability1 · 1 read
CVE-2026-102497
Stack Overflow DoS in Apache XMLSchema Schema Walker
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache XMLSchema's schema walker (xmlschema-walker) does not detect cycles in type derivation, substitution groups, model groups, or attribute groups. A malicious XML schema that contains such a cycle makes the walker recurse until the call stack overflows, crashing the process and causing a denial of service. An attacker who can supply a schema to an application using this walker can take that process down; the flaw does not indicate code execution or data theft. Applications that process untrusted schemas with Apache XMLSchema before the fix are affected. No public proof of concept is known, there is no evidence of exploitation in the wild, and the issue is not on the CISA KEV list.
What to do: Upgrade Apache XMLSchema to version 2.3.3 or later. Until then, do not pass untrusted or user-supplied XML schemas to xmlschema-walker, and isolate or restart processes that parse external schemas so a stack overflow cannot take down shared services.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache XMLSchema (xmlschema-walker) | versions before 2.3.3 (fixed in 2.3.3) |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.