CVE-2026-12993
Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset
CVSS Score
6.5
EPSS Score
0.4%
EPSS Percentile
35th
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.
| CWE | CWE-776 |
| Vendor | red hat |
| Product | red hat build of apicurio registry 3.3.1 |
| Published | Jun 25, 2026 |
| Last Updated | Aug 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat build of apicurio registry 3.3.1
Be the first to know when new medium vulnerabilities affecting red hat red hat build of apicurio registry 3.3.1 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Red Hat / Red Hat build of Apicurio Registry 3.3.1
All versions affected Red Hat / Red Hat build of Apicurio Registry 3.3.1
All versions affected