CVE-2026-102496

Apache XMLSchema: Denial of service through deeply nested schema structures

7.5 High

CVE-2026-102496 is a high vulnerability (CVSS 7.5) in Apache Xmlschema, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. No source names a fixed version.

What does this mean?

Severity: 7.5 HighCVSS 3.1, CVE List
Exploit chance: 0.53%EPSS, 45th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.53%Up 0.2 points since Sep 30, 2026

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`eap8-apache-sshd` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:2.20.0-1.redhat_00002.1.el10eap	0:2.20.0-1.redhat_00002.1.el10eap
`eap8-bouncycastle` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:1.86.0-1.redhat_00001.1.el10eap	0:1.86.0-1.redhat_00001.1.el10eap
`eap8-bouncycastle-jmail` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:1.86.0-1.redhat_00001.1.el10eap	0:1.86.0-1.redhat_00001.1.el10eap
`eap8-bouncycastle-pg` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:1.86.0-1.redhat_00001.1.el10eap	0:1.86.0-1.redhat_00001.1.el10eap
`eap8-bouncycastle-pkix` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:1.86.0-1.redhat_00001.1.el10eap	0:1.86.0-1.redhat_00001.1.el10eap
`eap8-bouncycastle-prov` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:1.86.0-1.redhat_00001.1.el10eap	0:1.86.0-1.redhat_00001.1.el10eap
`eap8-bouncycastle-util` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:1.86.0-1.redhat_00001.1.el10eap	0:1.86.0-1.redhat_00001.1.el10eap
`eap8-eap-product-conf-parent` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:801.9.1-1.GA_redhat_00002.1.el10eap	0:801.9.1-1.GA_redhat_00002.1.el10eap
`eap8-eap-product-conf-wildfly-ee-feature-pack` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:801.9.1-1.GA_redhat_00002.1.el10eap	0:801.9.1-1.GA_redhat_00002.1.el10eap
`eap8-ironjacamar` Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs	before 0:3.1.1-1.Final_redhat_00001.1.el10eap	0:3.1.1-1.Final_redhat_00001.1.el10eap