Vulnerability GHSA-748j-wm96-4wh5
Medium Risk
MEDIUM RISK
CVSS Score: 6.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 26, 2026 at 12:32 AM UTC
Apicurio Registry is vulnerable to denial of service through XML entity expansion
2.1.4.Final - 3.2.5 and 3.3.0
2.1.4.Final - 3.2.5 and 3.3.0
Summary
Apicurio Registry is vulnerable to denial of service through XML entity expansion
Details
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.
Impacted packages
Timeline
Published
4 months ago
June 26, 2026 at 12:32 AM UTC
Fixed (3.3.1)
Unknown
Unknown
Fixed (3.2.6)
Unknown
Unknown
Last Modified
2 hours ago
November 04, 2026 at 06:30 PM UTC