Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset (CVE-2026-12993)

Why this deserves its current priority

CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps io.apicurio:apicurio-registry-schema-util-xml (maven), io.apicurio:apicurio-registry-schema-util-xml (maven), io.apicurio:apicurio-registry-schema-util-xml (maven), io.apicurio:apicurio-registry-schema-util-xml (maven). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:a:redhat:build_of_apicurio_registry::::::::	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
io.apicurio:apicurio-registry-schema-util-xmlmaven	>=3.3.0,<3.3.1	3.3.1
io.apicurio:apicurio-registry-schema-util-xmlmaven	<3.2.6	3.2.6
io.apicurio:apicurio-registry-schema-util-xmlmaven	>=3.3.0 <3.3.1	3.3.1
io.apicurio:apicurio-registry-schema-util-xmlmaven	>=0 <3.2.6	3.2.6

Recommended response

Check inventory. Check lockfiles and deployed manifests for io.apicurio:apicurio-registry-schema-util-xml, io.apicurio:apicurio-registry-schema-util-xml, io.apicurio:apicurio-registry-schema-util-xml.
Review the reported fix. Update io.apicurio:apicurio-registry-schema-util-xml to 3.3.1; io.apicurio:apicurio-registry-schema-util-xml to 3.2.6; io.apicurio:apicurio-registry-schema-util-xml to 3.3.1; io.apicurio:apicurio-registry-schema-util-xml to 3.2.6 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 26, 2026

Sources and claim methodology

Upstream source description

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.

Quoted source text, attributed separately from HOL analysis.

Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subsetCVE-2026-12993