The vulnerability arises because the DocumentBuilderAccessor in Apicurio Registry correctly blocks external DTD and schema access but fails to disable DOCTYPE declarations or enable the FEATURE_SECURE_PROCESSING flag. This allows an attacker with artifact-write permissions to submit XML documents with internal entity expansion payloads, specifically the billion-laughs variant, which can exhaust CPU and heap memory resources. The JAXP default limit of 64,000 entity expansions provides partial mitigation. There is no vendor advisory indication of an official fix or patch at this time.

Successful exploitation results in denial of service through resource exhaustion (CPU and heap memory) caused by recursive XML entity expansion. There is no impact on confidentiality or integrity reported. The attack requires artifact-write permissions, limiting the attacker scope. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12993 for current remediation guidance. Until a fix is available, restrict artifact-write permissions to trusted users only to reduce risk. The default JAXP entity expansion limit partially mitigates the impact but does not fully prevent denial of service.