CVE-2026-12993: Apicurio Registry XML Entity Expansion DoS

Technical summary

The vulnerability exists in Apicurio Registry's DocumentBuilderAccessor XML parsing implementation. While external DTD and schema access is properly blocked, the code does not disable DOCTYPE declarations or set FEATURE_SECURE_PROCESSING on the underlying DocumentBuilder. This permits entity-expansion attacks: an attacker can craft XML with internally defined entities that reference each other recursively. When the JAXP parser evaluates these entities, memory and CPU consumption grows exponentially. The Java platform's default limit of 64,000 entity expansions provides a safety boundary, but does not eliminate the risk of heap exhaustion or CPU starvation under sustained attack. This is classified as CWE-776 (Improper Restriction of Recursive Entity References in DTDs).

Business impact

The primary impact is service availability. An authenticated attacker (one holding artifact-write privileges in Apicurio Registry) can upload XML that degrades or stalls the registry service. In environments where Apicurio Registry is critical to API catalog management or schema governance, even intermittent availability loss disrupts development workflows and API publication pipelines. The vulnerability requires authentication, limiting blast radius to insider threats or compromised accounts within your organization. It does not expose data or allow privilege escalation.

Affected systems

Red Hat Build of Apicurio Registry is affected. Consult the Red Hat security advisory for specific version ranges. The flaw affects any Apicurio Registry deployment exposed to users or services with artifact-write permissions. Organizations should review role-based access controls to identify which accounts or service principals can upload artifacts.

Exploitability

Exploitation requires authentication and the artifact-write permission role. An attacker cannot exploit this remotely without valid credentials. The attack is straightforward—upload a malformed XML document—and does not require advanced tooling or interactions beyond standard API calls. Once the malicious XML is processed, denial-of-service occurs passively. The JAXP entity limit provides a speedbump but is not a complete mitigation, meaning repeated requests or deeply nested payloads may still cause observable performance degradation or memory pressure.

Remediation

Apply the security patch provided by Red Hat for the affected version series. Verify the patch version against the official Red Hat Apicurio Registry advisory. In parallel, review and enforce least-privilege access: restrict artifact-write permissions to trusted users and service accounts. Consider network-level controls to rate-limit artifact uploads or enforce authentication timeouts. If patching is delayed, monitor heap and CPU usage for anomalies during XML artifact uploads.

Patch guidance

Obtain the security patch from the Red Hat Build of Apicurio Registry release channels. The patch will harden DocumentBuilderAccessor by disabling DOCTYPE declarations and enabling FEATURE_SECURE_PROCESSING on the DocumentBuilder instance. Verify the exact patched version number in the Red Hat advisory before deploying. Test the patch in a staging environment with valid XML artifacts to confirm no legitimate functionality is broken. Roll out to production following your change control process.

Detection guidance

Monitor logs for repeated failed XML parsing events or unusual resource consumption (heap usage spikes, sustained high CPU) correlated with artifact uploads. Implement network flow monitoring to detect patterns of rapid or large XML document uploads. Use endpoint detection on the Registry service to observe process CPU and memory metrics during normal and attack scenarios. Log all artifact uploads with actor identity and source IP for forensic review. Consider implementing WAF rules to reject overly nested or entity-heavy XML at the ingress point.

Why prioritize this

This vulnerability scores CVSS 6.5 MEDIUM and is not on the Known Exploited Vulnerabilities list. However, it merits prompt attention because: (1) it is trivial to exploit given valid credentials, (2) it directly impacts service availability in a resource-constrained microservice environment, and (3) it may be overlooked if you have not reviewed XML security configurations recently. Prioritize patching after any critical or high-CVSS items, but do not defer indefinitely.

Risk score, explained

CVSS 6.5 reflects the attack vector (network-accessible), low complexity, and requirement for low-privilege authentication (artifact-write role). The impact is availability only (no confidentiality or integrity breach). The score would be higher if the vulnerability required no authentication or if it enabled data exfiltration; it would be lower if the service had built-in circuit breakers or if exploitation were difficult. The score is appropriate for a denial-of-service flaw in a service-layer component accessible to authenticated insiders or compromised low-privilege accounts.

Frequently asked questions