CVE-2026-102497: Apache Xmlschema

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Affected products

• Apache Xmlschema: before 2.3.3 (fixed in 2.3.3)

Published 2026-09-29. Last modified 2026-10-06.