Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 3.3.1 GA ]

This Red Hat security advisory covers multiple vulnerabilities fixed in the Red Hat build of Apicurio Registry 3.3.1 GA container images. Key issues include CVE-2026-12975, where an unhardened SAXParser in content-type detection allows blind XXE, SSRF, and billion-laughs denial of service attacks due to insecure XML parsing without secure processing features or external entity resolution disabled. Other vulnerabilities fixed include SSRF via WSDL import dereference (CVE-2026-12992), XML entity-expansion DoS via internal DTD subset (CVE-2026-12993), client-side DoS in Axios from unescaped regex metacharacters in XSRF cookie names (CVE-2026-44496), and multiple DOMPurify XSS issues (CVE-2026-49978, CVE-2026-41240). The advisory references CVSS scores where available and provides links for further details. The vulnerabilities impact XML processing and client-side sanitization components, potentially allowing code execution, denial of service, and SSRF attacks.

The vulnerabilities allow attackers to execute cross-site scripting attacks, cause denial of service through resource exhaustion, and perform server-side request forgery by exploiting XML parsing flaws and client-side sanitization issues. Specifically, CVE-2026-12975 enables attackers with artifact-write permission or unauthenticated attackers (under default configuration) to upload crafted XML documents that trigger blind SSRF or denial of service via entity expansion. The impact includes confidentiality loss through reading local files, availability impact via resource consumption, and potential bypass of protection mechanisms. The Axios vulnerability allows client-side denial of service. Overall, these issues pose a high security risk if unpatched.

Red Hat has released updated container images for Apicurio Registry 3.3.1 GA that address these vulnerabilities. Users should apply this update promptly after ensuring all prior relevant errata are applied. Detailed update instructions are available from Red Hat's official documentation. No vendor advisory states that no action is required or that the issues are already mitigated; therefore, applying the official update is the recommended remediation. Monitor Red Hat advisories for any further updates or mitigations.