The vulnerability in Red Hat build of Apicurio Registry 3 is due to the DocumentBuilderAccessor correctly blocking external DTD and schema access but failing to disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. This allows an attacker with artifact-write permissions to upload XML documents with internal entity expansion payloads, specifically the billion-laughs variant, which can exhaust CPU and heap resources. The JAXP default limit of 64,000 entity expansions provides partial mitigation. The CVSS 3.1 score is 6.5 (medium severity) with network attack vector, low attack complexity, requiring privileges (artifact-write), no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. No vendor advisory confirms a patch or fix at this time.

Successful exploitation can cause denial of service through CPU and heap exhaustion on the affected system, impacting availability. There is no direct impact on confidentiality or integrity. The attack requires artifact-write permissions, limiting the attacker scope to authorized users who can upload artifacts.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12993 for current remediation guidance. Until a fix is available, restrict artifact-write permissions to trusted users only and consider additional XML processing safeguards if possible. The default JAXP entity-expansion limit partially mitigates the risk.