CVEDB API

Vulnerabilities

By Date
Known Exploited
Advanced Search

Vulnerable Software

Vendors
Products

Vulnerability Details CVE-2026-12993

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 16.1%

CVSS Severity

CVSS v3 Score 6.5

References

https://access.redhat.com/security/cve/CVE-2026-12993
https://bugzilla.redhat.com/show_bug.cgi?id=2491692

Products affected by CVE-2026-12993

Redhat » Build Of Apicurio Registry » Version: 3.0

cpe:2.3:a:redhat:build_of_apicurio_registry:3.0
Redhat » Build Of Apicurio Registry » Version: 3.1

cpe:2.3:a:redhat:build_of_apicurio_registry:3.1
Redhat » Build Of Apicurio Registry » Version: 3.2

cpe:2.3:a:redhat:build_of_apicurio_registry:3.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-12993

Products

Pricing

Contact Us