The vulnerability in Red Hat build of Apicurio Registry 3 stems from the ContentTypeUtil.isParsableXml() method creating a SAXParserFactory without secure processing enabled or external entity resolution disabled. This improper restriction of XML external entity references (CWE-611) allows attackers with artifact-write permissions, or unauthenticated users under default configurations, to upload malicious XML documents. These documents can exploit the parser to perform blind SSRF by fetching external DTD/entities or cause denial of service through entity expansion attacks. The CVSS v3.1 score is 8.5 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, limited confidentiality impact, no integrity impact, and high availability impact. No official patch or remediation level is currently provided by Red Hat, and no known exploits are reported in the wild. The vendor advisory is available but does not specify a fix or mitigation.

An attacker with artifact-write permission or unauthenticated access (if default configuration is used) can exploit this vulnerability to cause blind server-side request forgery (SSRF) by forcing the server to fetch external entities defined in a crafted XML document. Additionally, the attacker can cause denial of service through entity expansion attacks. This impacts the availability of the service and can potentially expose internal network resources via SSRF. Confidentiality impact is limited, and integrity is not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-12975 for current remediation guidance. Until an official fix is available, consider restricting artifact-write permissions to trusted users only and avoid running the registry with default configurations that allow unauthenticated artifact uploads. Disabling external entity resolution in XML parsers or enabling secure processing features may mitigate the risk but should be verified against vendor recommendations.