CLEANSTART-2026-PW93836: Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows
Security vulnerability affects the spark-sc213-jdk17-py312 package. Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/spark-sc213-jdk17-py312to a version that resolves this vulnerability.Fixed in 4.2.0-r8
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
An attacker must cause the affected software to build a schema model from a malicious XML schema containing excessively deep nested schema structures. Processing that schema can recurse until the stack overflows.
What is the likely impact of successful exploitation?
Successful exploitation can cause a stack overflow while the schema is being parsed or modeled. The provided information supports a denial-of-service impact; it does not describe data exposure or code execution.
Who is exposed?
Deployments using the cleanstart/spark-sc213-jdk17-py312 package are affected when they process XML schemas that an attacker can supply or influence. The provided data does not state whether any particular configuration enables or prevents exposure.