Is CVE-2026-12993 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12993 being exploited in the wild.

How severe is CVE-2026-12993?

Medium severity, with a CVSS score of 6.5, published 26 June 2026.

Which products and versions are affected?

io.apicurio:apicurio-registry-schema-util-xml (Maven) >= 3.3.0, < 3.3.1, ECOSYSTEM:introduced=3.3.0,fixed=3.3.1.

Is there a fix for CVE-2026-12993?

Yes. io.apicurio:apicurio-registry-schema-util-xml (Maven): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12993 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12993?

Check whether you run io.apicurio:apicurio-registry-schema-util-xml (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12993: Red Hat Apicurio Registry XML entity expansion denial of service

Q: Is there a fix for CVE-2026-12993?

Yes. io.apicurio:apicurio-registry-schema-util-xml (Maven): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-12993 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-12993?

Check whether you run io.apicurio:apicurio-registry-schema-util-xml (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12993 · Severity: medium · CVSS 6.5 · Published 2026-06-26

Apicurio Registry, a tool used to manage and store data schemas, is vulnerable to a denial-of-service attack. An authorized user can upload a specially crafted XML file that forces the system to consume excessive memory and processing power. This can lead to service outages or significant performance degradation for all users of the registry.

Vendors: Maven.

Quick answers

Is CVE-2026-12993 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12993 being exploited in the wild.
How severe is CVE-2026-12993?: Medium severity, with a CVSS score of 6.5, published 26 June 2026.
Which products and versions are affected?: io.apicurio:apicurio-registry-schema-util-xml (Maven) >= 3.3.0, < 3.3.1, ECOSYSTEM:introduced=3.3.0,fixed=3.3.1.
Is there a fix for CVE-2026-12993?: Yes. io.apicurio:apicurio-registry-schema-util-xml (Maven): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12993 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12993?: Check whether you run io.apicurio:apicurio-registry-schema-util-xml (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.apicurio:apicurio-registry-schema-util-xml (Maven): upgrade to 3.3.1 or later

# set io.apicurio:apicurio-registry-schema-util-xml to 3.3.1 in your pom.xml or build.gradle

Technical details

A flaw exists in Apicurio Registry's XML parsing infrastructure, specifically within DocumentBuilderAccessor and SchemaFactoryAccessor. While the application correctly blocks external DTD and schema access, it fails to disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. This allows an attacker with artifact-write permissions to perform an internal entity-expansion attack (Billion Laughs variant). Although partially mitigated by the default JAXP entity expansion limit of 64,000, parallel uploads can still lead to CPU and heap exhaustion. The vulnerability is rooted in the failure to set 'disallow-doctype-decl' to true and the practice of swallowing SAXNotRecognizedExceptions in SchemaFactoryAccessor.

Affected products

Red Hat Apicurio Registry 3 3

Identifiers

CVE-2026-12993
GHSA-748j-wm96-4wh5

Timeline

2026-06-23: disclosed: Reported via Red Hat Bugzilla
2026-06-26: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.