GHSA-rcmh-vfq7-8gf4

Source

https://github.com/advisories/GHSA-rcmh-vfq7-8gf4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rcmh-vfq7-8gf4/GHSA-rcmh-vfq7-8gf4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rcmh-vfq7-8gf4

Aliases

CVE-2026-12992

Downstream

MINI (2)

Published

2026-06-26T00:32:05Z

Modified

2026-11-04T18:15:03Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator

Summary

Apicurio Registry allows upload of WSDL raising HTTP request

Details

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-04T18:10:03Z",
    "nvd_published_at": "2026-06-25T22:17:00Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / io.apicurio:apicurio-registry-schema-util-wsdl

Package

Name: io.apicurio:apicurio-registry-schema-util-wsdl; View open source insights on deps.dev
Purl: pkg:maven/io.apicurio/apicurio-registry-schema-util-wsdl

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.3.0

Fixed

3.3.1

Affected versions

3.*

3.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rcmh-vfq7-8gf4/GHSA-rcmh-vfq7-8gf4.json"

Maven / io.apicurio:apicurio-registry-schema-util-wsdl

Package

Name: io.apicurio:apicurio-registry-schema-util-wsdl; View open source insights on deps.dev
Purl: pkg:maven/io.apicurio/apicurio-registry-schema-util-wsdl

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.6

Affected versions

2.*

2.1.4.Final

2.1.5.Final

2.2.0.Final

2.2.1.Final

2.2.2.Final

2.2.3.Final

2.2.4.Final

2.2.5.Final

2.3.0.Final

2.3.1.Final

2.4.0.Final

2.4.1.Final

2.4.2.Final

2.4.3.Final

2.4.4.Final

2.4.5.Final

2.4.6.Final

2.4.7.Final

2.4.8.Final

2.4.9.Final

2.4.10.Final

2.4.11.Final

2.4.12.Final

2.4.13.Final

2.4.14.Final

2.5.0.Final

2.5.1.Final

2.5.2.Final

2.5.3.Final

2.5.5.Final

2.5.6.Final

2.5.7.Final

2.5.8.Final

2.5.9.Final

2.5.10.Final

2.5.11.Final

2.6.0.Final

2.6.1.Final

2.6.2.Final

2.6.3.Final

2.6.4.Final

2.6.5.Final

2.6.6.Final

2.6.7.Final

2.6.8.Final

2.6.9.Final

2.6.11.Final

2.6.12.Final

2.6.13.Final

3.*

3.0.0.M1

3.0.0.M2

3.0.0.M3

3.0.0.M4

3.0.0.M5

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.15

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rcmh-vfq7-8gf4/GHSA-rcmh-vfq7-8gf4.json"