CVE-2026-102497

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497 Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

info.cqframework:xsd-to-modelinfo (>=2.11.0, <=3.29.0), org.apache.drill.contrib:drill-format-xml (1.22.0) +2 more potentially affected by CVE-2026-102497 via org.apache.ws.xmlschema:xmlschema-walker (>=2.2.5, <=2.3.0)

org.apache.ws.xmlschema:xmlschema-walker MAVEN version =2.2.5, =2.11.0, =4.0.0, =5.4.0 Source cves: CVE-2026-102497 Source advisory: MEND:CVE-2026-102497...

EUVD-2026-88739

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497 Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497 Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497

The Apache XmlSchema walker (xmlschema-walker) is vulnerable to a denial of service because it fails to detect cycles in type derivation, substitution groups, model groups, or attribute groups. A malicious schema containing such cycles can cause the walker to recurse indefinitely until a stack ov...

CVE-2026-102497: Uncontrolled Recursion

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

PT-2026-102505

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...