CVE-2026-12993

Published: Jun 26, 2026Modified: Jul 6, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.

Affected (1)

Products: Redhat: Build Of Apicurio Registry

1 product

Build Of Apicurio Registry

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Apicurio Registry	From 3.0 to 3.2

Related CWEs

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (2)

https://access.redhat.com/security/cve/CVE-2026-12993

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2491692

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.