Executive brief
Apicurio Registry, a tool used to manage and store data schemas, is vulnerable to a denial-of-service attack. An authorized user can upload a specially crafted XML file that forces the system to consume excessive memory and processing power. This can lead to service outages or significant performance degradation for all users of the registry.
Technical details
A flaw exists in Apicurio Registry's XML parsing infrastructure, specifically within DocumentBuilderAccessor and SchemaFactoryAccessor. While the application correctly blocks external DTD and schema access, it fails to disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. This allows an attacker with artifact-write permissions to perform an internal entity-expansion attack (Billion Laughs variant). Although partially mitigated by the default JAXP entity expansion limit of 64,000, parallel uploads can still lead to CPU and heap exhaustion. The vulnerability is rooted in the failure to set 'disallow-doctype-decl' to true and the practice of swallowing SAXNotRecognizedExceptions in SchemaFactoryAccessor.
Affected products
- Red Hat Apicurio Registry 3 3
Timeline
- 2026-06-23: disclosed: Reported via Red Hat Bugzilla
- 2026-06-26: advisory: NVD publication date