Threats tagged 'ghsa-7g64-f2hm-vjxp'

A vulnerability in Apicurio Registry's ContentTypeUtil.isParsableXml() method allows attackers with artifact-write permission, or unauthenticated users under default configuration, to upload crafted XML documents that exploit an unhardened SAXParser. This can lead to blind server-side request forgery (SSRF) via external DTD/entity fetch or denial of service (DoS) through entity expansion. The flaw is identified as CWE-611 and affects versions prior to 3.2.6 and versions from 3.3.0 up to but not including 3.3.1. A patch is available in versions 3.2.6 and 3.3.1.