The vulnerability arises from the ContentTypeUtil.isParsableXml() method in Apicurio Registry 3, which creates a SAXParserFactory without enabling secure processing or disabling external entity resolution. This improper restriction of XML external entity references enables attackers with certain permissions or unauthenticated access under default configuration to upload malicious XML that triggers SSRF by fetching external DTD/entities or causes denial of service through entity expansion. The CVSS v3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and causing partial confidentiality impact and high availability impact. No official patch or remediation level is stated in the vendor advisory as of the published date. The vendor advisory URL is provided for ongoing updates.

An attacker with artifact-write permission or unauthenticated users (under default configuration) can exploit this vulnerability to perform blind server-side request forgery (SSRF) by causing the server to fetch external entities defined in a crafted XML document. Additionally, the attacker can cause denial of service by triggering entity expansion attacks. This impacts confidentiality partially and causes high availability impact by potentially disrupting service.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12975 for current remediation guidance. Until an official fix is available, consider restricting artifact-write permissions and reviewing default configuration to prevent unauthenticated uploads of XML content. Avoid processing untrusted XML documents or disable external entity resolution in XML parsers if possible.