CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
Apache XMLSchema before 2.3.3 can crash when cyclic schema definitions overflow the schema walker.
Apache XMLSchema before 2.3.3 is affected by CVE-2026-102497, which the reporter rates low. The xmlschema-walker component does not detect cycles in type derivation, substitution groups, model groups, or attribute groups. A malicious schema can force unbounded recursion and a stack overflow, causing denial of service. Users are advised to upgrade to version 2.3.3.
- CVE-2026-102497 is rated low and affects Apache XMLSchema before 2.3.3.
- The schema walker misses cycles in derivation, substitution groups, and model or attribute groups.
- A crafted schema recurses until stack overflow; version 2.3.3 fixes it.
- CVEs
- CVE-2026-102497
- Vendors
- Apache
- Products
- Apache XMLSchema
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102497 | Stack Overflow DoS in Apache XMLSchema Schema Walker | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Sep 29 Severity: low Affected versions: - Apache XMLSchema before 2. 3. 3 Description: The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.