Vulnerability GHSA-rcmh-vfq7-8gf4
High Risk
HIGH RISK
CVSS Score: 7.4
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
June 26, 2026 at 12:32 AM UTC
Apicurio Registry allows upload of WSDL raising HTTP request
2.1.4.Final - 3.2.5 and 3.3.0
2.1.4.Final - 3.2.5 and 3.3.0
Summary
Apicurio Registry allows upload of WSDL raising HTTP request
Details
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
Impacted packages
Timeline
Published
4 months ago
June 26, 2026 at 12:32 AM UTC
Fixed (3.3.1)
Unknown
Unknown
Fixed (3.2.6)
Unknown
Unknown
Last Modified
2 hours ago
November 04, 2026 at 06:15 PM UTC