EUVD-2026-39593
GHSA-748j-wm96-4wh5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible upload API requires explicitly granted artifact-write permission (PR:L); only availability impacted as entity expansion exhausts JVM resources without exposing data.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.
AnalysisAI
CPU and heap exhaustion in Apicurio Registry's XML artifact processing pipeline allows authenticated users with artifact-write permission to cause denial of service via billion-laughs entity expansion. The DocumentBuilderAccessor correctly blocks external DTD and schema resolution - preventing SSRF/XXE - but omits two complementary protections: disabling DOCTYPE declarations entirely and enabling JAXP's FEATURE_SECURE_PROCESSING flag, leaving the parser exposed to recursive internal entity expansion. No active exploitation (CISA KEV) or confirmed public exploit code has been identified at time of analysis; EPSS data was not provided in the input.
Technical ContextAI
Apicurio Registry is a Red Hat-backed schema and API artifact registry supporting Avro, JSON Schema, Protobuf, OpenAPI, and XML-based formats. Its XML ingestion path uses a Java DocumentBuilder configured by the DocumentBuilderAccessor class. CWE-776 (Improper Restriction of Recursive Entity References in DTDs - 'XML Bomb') identifies the root cause: the parser accepts DOCTYPE declarations containing internal entity definitions that reference each other exponentially. The canonical billion-laughs payload encodes a few hundred bytes of XML that the parser expands into gigabytes of in-memory strings. The implementation's existing mitigations - blocking external DTD resolution and schema access - prevent SSRF and classic XXE but do not address internal entity bombs. Two specific missing controls would close the gap: setting the Apache Xerces feature 'http://apache.org/xml/features/disallow-doctype-decl' to true (rejects any DOCTYPE declaration outright), or enabling javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING (which caps entity expansion). The JAXP platform default cap of 64,000 entity expansions provides partial mitigation, bounding but not eliminating the resource exhaustion vector.
RemediationAI
Consult https://access.redhat.com/security/cve/CVE-2026-12993 and https://bugzilla.redhat.com/show_bug.cgi?id=2491692 for the confirmed patched release once published - an exact fix version was not present in the provided input data, so 'patch available per vendor advisory' is the most that can be confirmed at this time. Until a patch is applied, the most effective compensating control is restricting artifact-write permissions to the minimum necessary set of trusted users, directly removing the PR:L prerequisite for exploitation. At the JVM/infrastructure layer, enforcing heap limits on the Registry process (JVM -Xmx flag) and OS-level CPU quotas caps the blast radius of any successful attempt but does not prevent the attack. If the DocumentBuilderFactory configuration is operator-accessible, setting the Xerces feature 'http://apache.org/xml/features/disallow-doctype-decl' to true on the DocumentBuilder will reject any XML upload containing a DOCTYPE declaration, eliminating the attack vector at the cost of rejecting legitimate DTD-bearing artifacts - assess whether your artifact corpus uses DOCTYPE before enabling. WAF-layer DOCTYPE keyword filtering is a lower-confidence workaround with higher false-positive risk.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today