CVE-2026-102497— Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
Quick assessment
Affected
Apache Software Foundation Apache XMLSchema
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache XmlSchema walker（xmlschema-walker）无法检测类型派生、替代组、模型组或属性组中的循环引用。恶意构造的包含此类循环的 XML Schema 可能导致该解析器陷入无限递归，直至栈溢出，从而引发拒绝服务（DoS）漏洞。 建议用户升级至 2.3.3 版本，该版本已修复此问题。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102497
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
Source: CVE Program / CVE List V5
Vulnerability Description
The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service.
Users are recommended to upgrade to version 2.3.3, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache XMLSchema | 0 ~ 2.3.3 | - |
|
II. Public POCs for CVE-2026-102497
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102497
请登录查看更多情报信息。
Other References for CVE-2026-102497 (1)
-
https://lists.apache.org/thread/1cj02tobjyhjqq723bvg78yxkqt1lk7k vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-29 · 19 CVEs total
| CVE-2026-102495 | Apache XMLSchema: Denial of service through unbounded recursion when resolving schema impo | |
| CVE-2026-91012 | Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalatio | |
| CVE-2026-91048 | Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege esc | |
| CVE-2026-91085 | Apache Karaf: config:install missing ACL entry allows privilege escalation to admin | |
| CVE-2026-92142 | Apache Karaf: Authorization bypass in JMX MBean lifecycle operations | |
| CVE-2026-81914 | Apache Airflow Google provider: Google Drive query injection via unescaped file and folder | |
| CVE-2026-81862 | Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credenti | |
| CVE-2026-81930 | Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer toke | |
| CVE-2026-86843 | Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute- | |
| CVE-2026-97395 | Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO req | |
| CVE-2026-102496 | Apache XMLSchema: Denial of service through deeply nested schema structures | |
| CVE-2026-66083 | Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasourc | |
| CVE-2026-82804 | Apache DolphinScheduler: Command Injection in the Alert Script Plugin | |
| CVE-2026-81569 | Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized | |
| CVE-2026-78214 | Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths | |
| CVE-2026-71899 | Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to | |
| CVE-2026-71898 | Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute | |
| CVE-2026-71897 | Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and ba |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-97395
Apache Polaris: Allows authorized table writers to redirect -
CVE-2026-71897
Apache DolphinScheduler: Allows unauthorized workflow operat -
CVE-2026-71898
Apache DolphinScheduler: Improper Authorization Allows Proje -
CVE-2026-71899
Apache DolphinScheduler: Missing Authorization in query-dyna -
CVE-2026-78214
Apache DolphinScheduler: Actuator Endpoint Authentication By
V. Comments for CVE-2026-102497
No comments yet