CVE-2026-102496— Apache XMLSchema: Denial of service through deeply nested schema structures
Quick assessment
Affected
Apache Software Foundation Apache XMLSchema
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache XmlSchema 在构建模式（schema）模型时，未对模式结构的嵌套深度进行限制，因此恶意构造的模式可能导致解析过程中发生递归调用，直至栈溢出。这将导致服务拒绝（DoS）攻击。 建议用户升级至 2.3.3 版本，该版本已修复此问题。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102496
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache XMLSchema: Denial of service through deeply nested schema structures
Source: CVE Program / CVE List V5
Vulnerability Description
Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.
Users are recommended to upgrade to version 2.3.3, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache XMLSchema | 0 ~ 2.3.3 | - |
|
II. Public POCs for CVE-2026-102496
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102496
请登录查看更多情报信息。
Other References for CVE-2026-102496 (1)
-
https://lists.apache.org/thread/9z1vg8wmvwpfw748fb2nb55w4hgbnxol vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-29 · 19 CVEs total
| CVE-2026-102495 | Apache XMLSchema: Denial of service through unbounded recursion when resolving schema impo | |
| CVE-2026-91012 | Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalatio | |
| CVE-2026-91048 | Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege esc | |
| CVE-2026-91085 | Apache Karaf: config:install missing ACL entry allows privilege escalation to admin | |
| CVE-2026-92142 | Apache Karaf: Authorization bypass in JMX MBean lifecycle operations | |
| CVE-2026-81914 | Apache Airflow Google provider: Google Drive query injection via unescaped file and folder | |
| CVE-2026-81862 | Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credenti | |
| CVE-2026-81930 | Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer toke | |
| CVE-2026-86843 | Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute- | |
| CVE-2026-97395 | Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO req | |
| CVE-2026-102497 | Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker | |
| CVE-2026-66083 | Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasourc | |
| CVE-2026-82804 | Apache DolphinScheduler: Command Injection in the Alert Script Plugin | |
| CVE-2026-81569 | Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized | |
| CVE-2026-78214 | Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths | |
| CVE-2026-71899 | Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to | |
| CVE-2026-71898 | Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute | |
| CVE-2026-71897 | Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and ba |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-97395
Apache Polaris: Allows authorized table writers to redirect -
CVE-2026-71897
Apache DolphinScheduler: Allows unauthorized workflow operat -
CVE-2026-71898
Apache DolphinScheduler: Improper Authorization Allows Proje -
CVE-2026-71899
Apache DolphinScheduler: Missing Authorization in query-dyna -
CVE-2026-78214
Apache DolphinScheduler: Actuator Endpoint Authentication By
V. Comments for CVE-2026-102496
No comments yet