Description
Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.
Users are recommended to upgrade to version 2.3.3, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache XMLSchema | < 2.3.3 | 2.3.3 |
Advisories 1
- WID-SEC-2026-4309 IBM TXSeries: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 3, 2026
References
- https://lists.apache.org/thread/9z1vg8wmvwpfw748fb2nb55w4hgbnxol vendor-advisory