CVE-2026-12975
Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
- Record
CVE-2026-12975- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H - Weakness
- CWE-611, CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2026-39574
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
- Record
EUVD-2026-39574- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7g64-f2hm-vjxp
Apicurio Registry utilities allow SSRF and denial of service through XML parsing
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
- Record
GHSA-7g64-f2hm-vjxp- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-04
NVD
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
- Record
CVE-2026-12975- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-7g64-f2hm-vjxp
Apicurio Registry utilities allow SSRF and denial of service through XML parsing
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
- Record
GHSA-7g64-f2hm-vjxp- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.apicurio:apicurio-registry-schema-util-commonMaven |
3.3.0 up to 3.3.1 | 3.3.1 |
io.apicurio:apicurio-registry-schema-util-commonMaven |
before 3.2.6 | 3.2.6 |
io.apicurio:apicurio-registry-schema-util-commonMaven |
before 3.2.6, plus listed versions 2.1.4.Final2.1.5.Final2.2.0.Final2.2.1.Final2.2.2.Final Show 45 moreShow less2.2.3.Final2.2.4.Final2.2.5.Final2.3.0.Final2.3.1.Final2.4.0.Final2.4.1.Final2.4.10.Final2.4.11.Final2.4.12.Final2.4.13.Final2.4.14.Final2.4.2.Final2.4.3.Final2.4.4.Final2.4.5.Final2.4.6.Final2.4.7.Final2.4.8.Final2.4.9.Final2.5.0.Final2.5.1.Final2.5.10.Final2.5.11.Final2.5.2.Final2.5.3.Final2.5.5.Final2.5.6.Final2.5.7.Final2.5.8.Final2.5.9.Final2.6.0.Final2.6.1.Final2.6.11.Final2.6.12.Final2.6.13.Final2.6.2.Final2.6.3.Final2.6.4.Final2.6.5.Final2.6.6.Final2.6.7.Final2.6.8.Final2.6.9.Final3.0.0 |
3.2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, references | OSV | |
| affected, facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-12975 is a high vulnerability (CVSS 8.5) in Red Hat Build Of Apicurio Registry 3.3.1, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in io.apicurio:apicurio-registry-schema-util-common 3.3.1.
References
access.redhat.com/errata/RHSA-2026:59360
bugzilla.redhat.com/show_bug.cgi?id=2491688
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json
nvd.nist.gov/vuln/detail/CVE-2026-12975
github.com/Apicurio/apicurio-registry/issues/8187
Show 7 moreShow less
Left out here: 34 versions. The JSON record has them.