{"schema_version": "1.6.1", "id": "CVE-2026-102497", "summary": "Denial of service through cyclic schema definitions in the schema walker", "details": "The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service.\n\nUsers are recommended to upgrade to version 2.3.3, which fixes this issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "2.3.3"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/1cj02tobjyhjqq723bvg78yxkqt1lk7k"}]}