CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service.
Users are recommended to upgrade to version 2.3.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache XmlSchemato a version that resolves this vulnerability.Fixed in 2.3.3
Event History
Frequently Asked Questions
What must an attacker provide to trigger the denial of service?
An attacker needs to cause the xmlschema-walker to process a malicious XML schema containing cyclic definitions in type derivation, substitution groups, model groups, or attribute groups. The cycle can cause unbounded recursion until the process stack overflows.
Which deployments are exposed?
Deployments are exposed if they use the Apache XmlSchema walker and process untrusted or attacker-controlled schemas. The provided information does not establish whether schemas processed only from trusted sources are affected in practice.
What version addresses the issue?
Upgrade Apache XMLSchema to version 2.3.3, which fixes the missing cycle detection in the walker.