Executive brief
Apicurio Registry, a service for managing API and schema artifacts, contains a security flaw in how it processes XML files. An attacker can upload a specially crafted XML document to trick the server into making unauthorized internal network requests or to crash the service by consuming excessive resources. This could lead to the exposure of internal infrastructure details or a disruption of registry operations.
Technical details
The vulnerability exists in the `ContentTypeUtil.isParsableXml()` method, which initializes a `SAXParserFactory` without enabling `FEATURE_SECURE_PROCESSING` or disabling external entity resolution (e.g., `disallow-doctype-decl`). This method is triggered during artifact-type inference when a client uploads content via the REST API or Confluent-compatible endpoints. An attacker with artifact-write permissions (or unauthenticated users in default configurations) can submit XML containing malicious DTDs. This can be leveraged for blind SSRF to probe internal networks/cloud metadata or for 'Billion Laughs' style Denial of Service attacks. The flaw is tracked as CWE-611.
Affected products
- Red Hat Red Hat build of Apicurio Registry 3 3
- Apicurio Apicurio Registry
Timeline
- 2026-06-23: disclosed: Reported via Red Hat Bugzilla
- 2026-06-25: advisory: NVD and Red Hat published advisory details