---
id: CVE-2026-102495
title: >-
  Apache XmlSchema doesn't limit how deeply schema imports and includes can be
  nested, so a malicious schema can make parsing recurse until the stack
  overflows
summary: >-
  Apache XmlSchema doesn't limit how deeply schema imports and includes can be
  nested, so a malicious schema can make parsing recurse until the stack
  overflows. This causes a denial of service.

  Users are recommended to upgrade to version 2…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
  - CWE-770
vendor: apache
product: xmlschema
affected:
  - xmlschema < 2.3.3
patched:
  - xmlschema 2.3.3
published: '2026-09-29'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T14:38:53.533'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102495'
references:
  - url: 'https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6s'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/29/15'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102495.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-102495'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543083'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-102495'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102495'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00528
epssPercentile: 0.44481
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-29T20:05:29.847614Z'
ingestedAt: '2026-09-29T12:33:37.291Z'
---

## Overview

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.
Users are recommended to upgrade to version 2.3.3, which fixes this issue.

## Affected

- `xmlschema < 2.3.3`

## Remediation

Upgrade past the affected range:

- `xmlschema 2.3.3`

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat OpenShift AI (RHOAI), Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102495.json)