CVE-2026-102497
Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.
| Vendor | apache software foundation |
| Product | apache xmlschema |
| Published | Sep 29, 2026 |
| Last Updated | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache xmlschema
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache xmlschema are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache XMLSchema
0 < 2.3.3
References
Credits
This issue was found using Claude agents to study the security of open-source projects