GHSA-7g64-f2hm-vjxp

Source

https://github.com/advisories/GHSA-7g64-f2hm-vjxp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7g64-f2hm-vjxp/GHSA-7g64-f2hm-vjxp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7g64-f2hm-vjxp

Aliases

CVE-2026-12975

Downstream

CGA (2)

MINI (1)

MINI-x6jm-v4vp-xp9v

Published

2026-06-26T00:32:05Z

Modified

2026-11-04T18:00:05Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H CVSS Calculator

Summary

Apicurio Registry utilities allow SSRF and denial of service through XML parsing

Details

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.

Database specific

{
    "cwe_ids": [
        "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-04T17:49:18Z",
    "nvd_published_at": "2026-06-25T22:17:00Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / io.apicurio:apicurio-registry-schema-util-common

Package

Name: io.apicurio:apicurio-registry-schema-util-common; View open source insights on deps.dev
Purl: pkg:maven/io.apicurio/apicurio-registry-schema-util-common

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.3.0

Fixed

3.3.1

Affected versions

3.*

3.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7g64-f2hm-vjxp/GHSA-7g64-f2hm-vjxp.json"

Maven / io.apicurio:apicurio-registry-schema-util-common

Package

Name: io.apicurio:apicurio-registry-schema-util-common; View open source insights on deps.dev
Purl: pkg:maven/io.apicurio/apicurio-registry-schema-util-common

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.6

Affected versions

2.*

2.1.4.Final

2.1.5.Final

2.2.0.Final

2.2.1.Final

2.2.2.Final

2.2.3.Final

2.2.4.Final

2.2.5.Final

2.3.0.Final

2.3.1.Final

2.4.0.Final

2.4.1.Final

2.4.2.Final

2.4.3.Final

2.4.4.Final

2.4.5.Final

2.4.6.Final

2.4.7.Final

2.4.8.Final

2.4.9.Final

2.4.10.Final

2.4.11.Final

2.4.12.Final

2.4.13.Final

2.4.14.Final

2.5.0.Final

2.5.1.Final

2.5.2.Final

2.5.3.Final

2.5.5.Final

2.5.6.Final

2.5.7.Final

2.5.8.Final

2.5.9.Final

2.5.10.Final

2.5.11.Final

2.6.0.Final

2.6.1.Final

2.6.2.Final

2.6.3.Final

2.6.4.Final

2.6.5.Final

2.6.6.Final

2.6.7.Final

2.6.8.Final

2.6.9.Final

2.6.11.Final

2.6.12.Final

2.6.13.Final

3.*

3.0.0.M1

3.0.0.M2

3.0.0.M3

3.0.0.M4

3.0.0.M5

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.15

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7g64-f2hm-vjxp/GHSA-7g64-f2hm-vjxp.json"