Apache Xmlschema vulnerabilities

3 CVEs affecting Apache Xmlschema, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-102497, published 2026-09-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-102497, published 2026-09-29. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the…
CVE-2026-102496, published 2026-09-29. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a…
CVE-2026-102495, published 2026-09-29. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users…