Apache XMLSchema before 2.3.3: three low-severity stack-overflow denial-of-service flaws (CVE-2026-102495, CVE-2026-102496, CVE-2026-102497)

Three low-severity CVEs in Apache XMLSchema before 2.3.3 allow malicious schemas to trigger unbounded recursion and stack-overflow denial of service; upgrading to 2.3.3 fixes all three.

On 2026-09-29, oss-security carried three reports of low-severity denial-of-service flaws in Apache XMLSchema before 2.3.3, each fixed by upgrading to 2.3.3. CVE-2026-102495 (posted 11:14 UTC) concerns unbounded recursion while resolving schema imports and includes: the library does not limit how deeply imports can be nested, so a malicious schema can recurse until the stack overflows; the report says the flaw was found using Claude agents studying open-source security. CVE-2026-102496 (posted 11:16 UTC) is a separate flaw in which nesting depth is not limited while the schema model is built, again allowing deeply nested structures to overflow the stack; this report also says the issue was found using Claude agents during a security review of the library. CVE-2026-102497 (posted 11:18 UTC) affects the xmlschema-walker, which does not detect cycles in type derivation, substitution groups, model groups, or attribute groups, so a cyclic schema can force unbounded recursion and a crash. The three reports agree on severity (low), affected versions (before 2.3.3), and the fix; they describe three distinct mechanisms rather than conflicting accounts of a single bug.