Xmlschema (Apache) - vulnerabilities (CVEs)

3 CVEs, 3 in the last 30 days, 16 known versions, newest CVE from 2026-09-29. Vendor: Apache.

CVEs of Xmlschema

• CVE-2026-102497 - CVSS 7.5 (high), 2026-09-29: The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious…
• CVE-2026-102496 - CVSS 7.5 (high), 2026-09-29: Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse…
• CVE-2026-102495 - CVSS 7.5 (high), 2026-09-29: Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows.…