CVE-2026-102496: Apache Xmlschema

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Affected products

• Apache Xmlschema: before 2.3.3 (fixed in 2.3.3)

Published 2026-09-29. Last modified 2026-10-06.