CVE-2026-12975

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:59360
https://access.redhat.com/security/cve/CVE-2026-12975	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2491688	Issue Tracking Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:59360
https://access.redhat.com/security/cve/CVE-2026-12975	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2491688	Issue Tracking Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en Apicurio Registry. El método ContentTypeUtil.isParsableXml() crea una SAXParserFactory sin habilitar las características de procesamiento seguro ni deshabilitar la resolución de entidades externas. Un atacante con permiso de escritura de artefactos (o sin autenticar cuando el registro se ejecuta con la configuración predeterminada) puede cargar un documento XML manipulado para desencadenar una falsificación de petición del lado del servidor (SSRF) ciega a través de la recuperación de DTD/entidades externas, o causar una denegación de servicio a través de la expansión de entidades.

Information

Published : 2026-06-25 22:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-12975

Mitre link : CVE-2026-12975

CVE.ORG link : CVE-2026-12975

JSON object : View

Products Affected

redhat

build_of_apicurio_registry

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-12975", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12975", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T13:38:33.702476Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "packageName": "apicurio/apicurio-registry-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "packageName": "apicurio/apicurio-registry-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "versions": [{"status": "unaffected", "version": "registry-rhel8", "lessThan": "*", "versionType": "rpm"}, {"status": "unaffected", "version": "registry-rhel9", "lessThan": "*", "versionType": "rpm"}], "packageName": "apicurio/apicurio", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-25T22:17:00.620", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59360", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12975", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59360", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12975", "tags": ["Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json", "tags": ["Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-611"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Apicurio Registry. El m\u00e9todo ContentTypeUtil.isParsableXml() crea una SAXParserFactory sin habilitar las caracter\u00edsticas de procesamiento seguro ni deshabilitar la resoluci\u00f3n de entidades externas. Un atacante con permiso de escritura de artefactos (o sin autenticar cuando el registro se ejecuta con la configuraci\u00f3n predeterminada) puede cargar un documento XML manipulado para desencadenar una falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) ciega a trav\u00e9s de la recuperaci\u00f3n de DTD/entidades externas, o causar una denegaci\u00f3n de servicio a trav\u00e9s de la expansi\u00f3n de entidades."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B80ACBA3-FFCF-44E6-A77E-0BD398F0C4D7", "versionEndIncluding": "3.2", "versionStartIncluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}