< Back

CVE-2026-102495

Updated on 29 Sep 2026

Severity

7.5 High severity

Details

CVSS score
7.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Apache XmlSchema doesn’t limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Details

Affected product:
Apache CXF , Wildfly , camel , chemistry-opencmis , gora , karaf , opencmis , sentimentanalysisparser , tika , trunk , ws-xmlschema
Affected packages:
xmlschema-core @ 2.3.1 (+2453 more)