CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures
Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache XMLSchemato a version that resolves this vulnerability.Fixed in 2.3.3
Event History
Frequently Asked Questions
What does an attacker need to trigger the denial of service?
An attacker needs to supply a malicious XML schema containing deeply nested schema structures that are processed by Apache XmlSchema. Parsing that schema can recurse until the stack overflows.
What should teams do if they use Apache XmlSchema?
Upgrade to Apache XmlSchema version 2.3.3, which fixes the issue. If an immediate upgrade is not possible, avoid processing schemas from untrusted sources where feasible.