CVE-2026-12975

Katalog CVE

CVSS 8.5 · High EPSS 0,44%

Kerentanan Improper Restriction of XML External Entity Reference pada redhat build of apicurio registry. Skor CVSS 3.1 8.5 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

26 Agustus 2026

Status NVD

Modified

CVSS 3.1

8.5 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-12975 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2491688 issue tracking · advisory vendor
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json advisory vendor
• https://access.redhat.com/errata/RHSA-2026:59360