CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures
Apache XMLSchema before 2.3.3 allows denial of service via deeply nested schemas that overflow the stack.
CVE-2026-102496, rated low, affects Apache XMLSchema before 2.3.3. The library does not limit how deeply schema structures can be nested while building its schema model, so a malicious schema can recurse until the stack overflows and deny service. The recommended fix is version 2.3.3. The report says the flaw was found using Claude agents while studying the library’s security.
- CVE-2026-102496 is a low-severity denial of service in Apache XMLSchema before 2.3.3.
- The parser does not limit nesting depth while building the schema model.
- Malicious schemas recurse to a stack overflow; upgrading to 2.3.3 fixes it.
- The report says Claude agents found the issue during a security review.
- CVEs
- CVE-2026-102496
- Vendors
- Apache
- Products
- Apache XMLSchema
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102496 | Stack overflow DoS in Apache XmlSchema via nested schemas | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Sep 29 Severity: low Affected versions: - Apache XMLSchema before 2. 3. 3 Description: Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.