CVE-2026-102495— Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes
Quick assessment
Affected
Apache Software Foundation Apache XMLSchema
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache XmlSchema 未限制架构导入（imports）和包含（includes）的嵌套深度，因此恶意架构可能导致解析过程递归执行，直到栈溢出。这将导致拒绝服务（DoS）漏洞。 建议用户升级到 2.3.3 版本，该版本已修复此问题。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102495
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes
Source: CVE Program / CVE List V5
Vulnerability Description
Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.
Users are recommended to upgrade to version 2.3.3, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache XMLSchema | 0 ~ 2.3.3 | - |
|
II. Public POCs for CVE-2026-102495
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102495
请登录查看更多情报信息。
Other References for CVE-2026-102495 (1)
-
https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6s vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-29 · 19 CVEs total
| CVE-2026-102496 | Apache XMLSchema: Denial of service through deeply nested schema structures | |
| CVE-2026-91012 | Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalatio | |
| CVE-2026-91048 | Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege esc | |
| CVE-2026-91085 | Apache Karaf: config:install missing ACL entry allows privilege escalation to admin | |
| CVE-2026-92142 | Apache Karaf: Authorization bypass in JMX MBean lifecycle operations | |
| CVE-2026-81914 | Apache Airflow Google provider: Google Drive query injection via unescaped file and folder | |
| CVE-2026-81862 | Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credenti | |
| CVE-2026-81930 | Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer toke | |
| CVE-2026-86843 | Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute- | |
| CVE-2026-97395 | Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO req | |
| CVE-2026-102497 | Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker | |
| CVE-2026-66083 | Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasourc | |
| CVE-2026-82804 | Apache DolphinScheduler: Command Injection in the Alert Script Plugin | |
| CVE-2026-81569 | Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized | |
| CVE-2026-78214 | Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths | |
| CVE-2026-71899 | Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to | |
| CVE-2026-71898 | Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute | |
| CVE-2026-71897 | Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and ba |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-97395
Apache Polaris: Allows authorized table writers to redirect -
CVE-2026-71897
Apache DolphinScheduler: Allows unauthorized workflow operat -
CVE-2026-71898
Apache DolphinScheduler: Improper Authorization Allows Proje -
CVE-2026-71899
Apache DolphinScheduler: Missing Authorization in query-dyna -
CVE-2026-78214
Apache DolphinScheduler: Actuator Endpoint Authentication By
V. Comments for CVE-2026-102495
No comments yet