Description
Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.
Users are recommended to upgrade to version 2.3.3, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache XMLSchema | < 2.3.3 | 2.3.3 |
Advisories 1
- WID-SEC-2026-4309 IBM TXSeries: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 3, 2026
References
- https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6s vendor-advisory