Vulnerability GHSA-7g64-f2hm-vjxp
High Risk
HIGH RISK
CVSS Score: 8.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
June 26, 2026 at 12:32 AM UTC
Apicurio Registry utilities allow SSRF and denial of service through XML parsing
2.1.4.Final - 3.2.5 and 3.3.0
2.1.4.Final - 3.2.5 and 3.3.0
Summary
Apicurio Registry utilities allow SSRF and denial of service through XML parsing
Details
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Impacted packages
Timeline
Published
4 months ago
June 26, 2026 at 12:32 AM UTC
Fixed (3.3.1)
Unknown
Unknown
Fixed (3.2.6)
Unknown
Unknown
Last Modified
3 hours ago
November 04, 2026 at 06:00 PM UTC