Apache Xmlschema
Monthly
Stack exhaustion in the Apache XmlSchema walker (xmlschema-walker) allows a malicious XML Schema to crash any application that parses untrusted XSD/WSDL content, because the walker performs no cycle detection across type derivations, substitution groups, model groups, or attribute groups and recurses until the stack overflows. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is limited to availability impact - no data disclosure or code execution. It is a third-party library issue rather than a directly network-exposed service: only deployments that walk attacker-controlled or third-party schemas are realistically exploitable, no public exploit code has been identified at time of analysis, and remediation is the vendor-released patch in version 2.3.3.
Stack exhaustion in Apache XmlSchema allows remote attackers to cause a denial of service by supplying a malicious XML Schema (XSD) document with deeply nested structures that recurse until the parsing thread's stack overflows. The library is a Java component, so exposure depends entirely on the host application accepting and parsing externally supplied schemas - deployments that only process trusted, internally authored schemas are not affected, and no authentication or user interaction is inherent to the flaw. No public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing); the vendor-released fix is XmlSchema 2.3.3, and the assessed severity is CVSS:3.1 7.5 (High, availability-only).
Stack overflow denial of service in Apache XmlSchema versions before 2.3.3 allows unauthenticated remote attackers to crash applications that parse attacker-controlled XML schemas by supplying a schema with deeply nested imports or includes. The library lacks a recursion depth limit during schema resolution, so a malicious schema can exhaust the call stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the flaw carries a high availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects deployments that ingest untrusted schemas.
Stack exhaustion in the Apache XmlSchema walker (xmlschema-walker) allows a malicious XML Schema to crash any application that parses untrusted XSD/WSDL content, because the walker performs no cycle detection across type derivations, substitution groups, model groups, or attribute groups and recurses until the stack overflows. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is limited to availability impact - no data disclosure or code execution. It is a third-party library issue rather than a directly network-exposed service: only deployments that walk attacker-controlled or third-party schemas are realistically exploitable, no public exploit code has been identified at time of analysis, and remediation is the vendor-released patch in version 2.3.3.
Stack exhaustion in Apache XmlSchema allows remote attackers to cause a denial of service by supplying a malicious XML Schema (XSD) document with deeply nested structures that recurse until the parsing thread's stack overflows. The library is a Java component, so exposure depends entirely on the host application accepting and parsing externally supplied schemas - deployments that only process trusted, internally authored schemas are not affected, and no authentication or user interaction is inherent to the flaw. No public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing); the vendor-released fix is XmlSchema 2.3.3, and the assessed severity is CVSS:3.1 7.5 (High, availability-only).
Stack overflow denial of service in Apache XmlSchema versions before 2.3.3 allows unauthenticated remote attackers to crash applications that parse attacker-controlled XML schemas by supplying a schema with deeply nested imports or includes. The library lacks a recursion depth limit during schema resolution, so a malicious schema can exhaust the call stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the flaw carries a high availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects deployments that ingest untrusted schemas.