CVE-2026-12975EPSS p14.3%

CVE-2026-12975CVE-2026-12975

redhat / build_of_apicurio_registry

Description

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.

Scoring

CVSS 8.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
EPSS0.23% probability of exploitation · percentile 14.3% · 2026-08-11T12:00:17Z
Last modified2026-07-15
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.