CVE-2026-102495: Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes
Apache XMLSchema before 2.3.3 allows denial of service via stack overflow from deeply nested schema imports; upgrading fixes CVE-2026-102495.
Apache XMLSchema before 2.3.3 does not limit how deeply schema imports and includes can be nested, so a malicious schema can drive parsing recursion until the stack overflows, causing denial of service. The flaw is tracked as CVE-2026-102495 and rated low severity. The issue was found using Claude agents to study open-source security; users are advised to upgrade to version 2.3.3.
- CVE-2026-102495, rated low, affects Apache XMLSchema versions before 2.3.3.
- Malicious schema nesting triggers unbounded recursion and stack-overflow denial of service.
- Flaw found using Claude agents auditing open-source security; upgrade to 2.3.3.
- CVEs
- CVE-2026-102495
- Organizations
- Apache XMLSchemaColm O hEigeartaigh
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102495 | Unbounded recursion DoS in Apache XmlSchema | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Sep 29 Severity: low Affected versions: - Apache XMLSchema before 2. 3. 3 Description: Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.