← Back

CVE-2026-12975

nvd nist
Published: Jun 25, 2026Modified: Jul 15, 2026

JSON object

Loading...
8.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
Exploitability: 3.1 / Impact: 4.7
Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.

Affected (1)

Redhat
1 product
Build Of Apicurio Registry
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Build Of Apicurio Registry
From 3.0 to 3.2

Related CWEs

CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (5)

Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Issue TrackingVendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory

Timeline

No history available yet.