CVE-2026-102495

HighCVSS 7.5/10Last modified Oct 6, 2026

Description

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache XMLSchema	< 2.3.3

References

https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6sMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/29/15Mailing List, Third Party Advisory

Timeline

Published: Sep 29, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1024967.5Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make pa CVE-2026-1024977.5The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute grou CVE-2026-1024997.7The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and CVE-2026-10256.1IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. T CVE-2026-102507.3A security flaw has been discovered in itsourcecode Online Blood Bank Management System 1.0. The affected element is an unknown function of CVE-2026-1025015.3CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke CVE-2026-1025025.3CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security fea CVE-2026-1025039.3Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressS CVE-2026-1025047.5Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. N CVE-2026-1025056.3Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted im CVE-2026-1025075.7Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker CVE-2026-1025089.2Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an