CVE-2026-12993

Name of the Vulnerable Software and Affected Versions Apicurio Registry (affected versions not specified)

Description A flaw exists in the DocumentBuilderAccessor where DOCTYPE declarations are not disabled and FEATURE SECURE PROCESSING is not enabled. Although external DTD and schema access are blocked, an attacker with artifact-write permissions can upload XML documents containing internal entity-expansion payloads, such as the billion-laughs variant. This can lead to CPU and heap exhaustion, though the JAXP default limit of 64,000 entity expansions provides partial mitigation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.