CVE-2026-12975

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12975", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-23T10:44:04.308Z", "datePublished": "2026-06-25T21:12:31.301Z", "dateUpdated": "2026-08-26T12:04:54.899Z"}, "containers": {"cna": {"title": "Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "apicurio/apicurio-registry-rhel8", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "apicurio/apicurio-registry-rhel9", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59360", "name": "RHSA-2026:59360", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12975", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688", "name": "RHBZ#2491688", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-06-10T13:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-611: Improper Restriction of XML External Entity Reference", "timeline": [{"lang": "en", "time": "2026-05-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-08-25T14:27:35.627Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T13:38:33.702476Z", "id": "CVE-2026-12975", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T13:38:49.707Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "defaultStatus": "affected", "packageName": "apicurio/apicurio", "product": "Red Hat build of Apicurio Registry 3.3.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "registry-rhel8", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "registry-rhel9", "versionType": "rpm"}]}], "datePublic": "2026-06-10T13:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-12975"}, {"name": "RHBZ#2491688", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:59360"}], "solutions": [{"lang": "en", "value": "RHSA-2026:59360: Red Hat build of Apicurio Registry 3.3.1"}], "timeline": [{"lang": "en", "time": "2026-05-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:00:00.000Z", "value": "Made public."}], "title": "Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-26T12:04:54.899Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "versions": [{"status": "unaffected", "version": "registry-rhel8", "lessThan": "*", "versionType": "rpm"}, {"status": "unaffected", "version": "registry-rhel9", "lessThan": "*", "versionType": "rpm"}], "packageName": "apicurio/apicurio", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:00:00.000Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:59360: Red Hat build of Apicurio Registry 3.3.1"}], "x_adpType": "supplier", "datePublic": "2026-06-10T13:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-12975", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688", "name": "RHBZ#2491688", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59360", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-26T12:04:54.899Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12975", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T13:38:33.702476Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T13:38:41.195Z"}}], "cna": {"title": "Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "packageName": "apicurio/apicurio-registry-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "packageName": "apicurio/apicurio-registry-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:00:00.000Z", "value": "Made public."}], "datePublic": "2026-06-10T13:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59360", "name": "RHSA-2026:59360", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12975", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688", "name": "RHBZ#2491688", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-08-25T14:27:35.627Z"}, "x_redhatCweChain": "CWE-611: Improper Restriction of XML External Entity Reference"}}, "cveMetadata": {"cveId": "CVE-2026-12975", "state": "PUBLISHED", "dateUpdated": "2026-08-26T12:04:54.899Z", "dateReserved": "2026-06-23T10:44:04.308Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-06-25T21:12:31.301Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "defaultStatus": "unaffected", "packageName": "apicurio/apicurio-registry-rhel8", "product": "Red Hat build of Apicurio Registry 3.3.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "defaultStatus": "unaffected", "packageName": "apicurio/apicurio-registry-rhel9", "product": "Red Hat build of Apicurio Registry 3.3.1", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "defaultStatus": "affected", "packageName": "apicurio/apicurio", "product": "Red Hat build of Apicurio Registry 3.3.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "registry-rhel8", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "registry-rhel9", "versionType": "rpm"}]}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:*", "matchCriteriaId": "B80ACBA3-FFCF-44E6-A77E-0BD398F0C4D7", "versionEndIncluding": "3.2", "versionStartIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Apicurio Registry. El m\u00e9todo ContentTypeUtil.isParsableXml() crea una SAXParserFactory sin habilitar las caracter\u00edsticas de procesamiento seguro ni deshabilitar la resoluci\u00f3n de entidades externas. Un atacante con permiso de escritura de artefactos (o sin autenticar cuando el registro se ejecuta con la configuraci\u00f3n predeterminada) puede cargar un documento XML manipulado para desencadenar una falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) ciega a trav\u00e9s de la recuperaci\u00f3n de DTD/entidades externas, o causar una denegaci\u00f3n de servicio a trav\u00e9s de la expansi\u00f3n de entidades."}], "id": "CVE-2026-12975", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12975", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T13:38:33.702476Z", "version": "2.0.3"}}]}, "published": "2026-06-25T22:17:00.620", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59360"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-12975"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:59360"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-12975"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Vendor Advisory"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-611"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS", "id": "2491688", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-611", "details": ["A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion."], "name": "CVE-2026-12975", "package_state": [{"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "apicurio/apicurio-registry-rhel8", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "apicurio/apicurio-registry-rhel9", "product_name": "Red Hat build of Apicurio Registry 3"}], "public_date": "2026-06-10T13:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12975\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12975"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 80.0, "source": "matching"}]}, "original": {"product": "Red Hat build of Apicurio Registry 3", "source": "cna", "vendor": "Red Hat"}, "product": "apicurio_registry", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "apicurio_registry", "vendor": "redhat"}], "created": "2026-06-25T22:30:15.192019+00:00", "updated": "2026-06-26T07:15:16.845581+00:00", "vendors": ["redhat", "redhat$PRODUCT$apicurio_registry"]}