Denial of Service Vulnerability in Apache XmlSchema
CVE-2026-102496

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Xmlschema
Vendor
CVE Published:
29 September 2026

What is CVE-2026-102496?

The Apache XmlSchema library is susceptible to a denial of service attack due to improper handling of deeply nested schema structures. Attackers can exploit this vulnerability by crafting a malicious schema that triggers excessive recursive parsing, ultimately leading to a stack overflow. This can render applications using the library unresponsive. To protect against this issue, it is advised to upgrade to version 2.3.3 or later, which addresses the flaw.

Affected Version(s)

Apache XMLSchema 0 < 2.3.3

References

https://lists.apache.org/thread/9z1vg8wmvwpfw748fb2nb55w4...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was found using Claude agents to study the security of open-source projects
.