A flaw was found in Apache XMLSchema. The parser does not properly restrict how deeply schema imports and includes can be nested during processing. A remote attacker could provide a crafted schema with deeply nested references, triggering unbounded recursion that exhausts the call stack. This flaw leads to an application crash, resulting in a Denial of Service (DoS).
Last checked: 2026-10-06 16:33 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 20:05 UTC)
Fix evidence last checked: 2026-10-06 12:30 UTC