CVE-2026-12975

Name of the Vulnerable Software and Affected Versions Apicurio Registry (affected versions not specified)

Description A flaw exists in the ContentTypeUtil.isParsableXml() function, which creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. This allows an attacker with artifact-write permissions, or an unauthenticated user if the registry uses the default configuration, to upload a crafted XML document. This can lead to blind server-side request forgery (SSRF)—where the server is coerced into making requests to an unintended location—via external DTD or entity fetch, or result in a denial of service through entity expansion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.