CVE-2026-102496
Received Received - Intake

Apache XmlSchema Stack Overflow Denial of Service

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Apache Software Foundation

Description
Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102496
EUVD
EUVD-2026-88738

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache xmlschema 2.3.3
apache xmlschema to 2.3.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Apache XmlSchema allowing deeply nested schema structures without limits. A malicious schema can cause infinite recursion during parsing, leading to a stack overflow and denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for stack overflow errors during XML schema parsing. Check application logs for stack overflow exceptions or crashes when processing XML files. No specific commands are provided in the context.

Impact Analysis

The impact includes system crashes or unresponsiveness due to stack overflow, disrupting services that rely on Apache XmlSchema for XML schema processing.

Compliance Impact

This vulnerability primarily causes a denial of service by triggering stack overflows during schema parsing. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged downtime from a denial of service could indirectly affect compliance by disrupting access to critical systems handling personal or health data.

Mitigation Strategies

Upgrade Apache XmlSchema to version 2.3.3 or later to fix the issue. If upgrading is not immediately possible, restrict or monitor XML schema processing to prevent malicious schemas from causing stack overflows.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart