CVE-2026-12993: Apicurio Registry DoS Vulnerability

CVE-2026-12993 Overview

CVE-2026-12993 is a denial-of-service vulnerability in Apicurio Registry. The DocumentBuilderAccessor class blocks external Document Type Definition (DTD) and schema access but fails to disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An authenticated attacker with artifact-write permission can upload XML documents containing internal entity-expansion payloads, commonly known as the billion-laughs attack. The malicious payload triggers CPU and heap exhaustion on the registry service. The Java API for XML Processing (JAXP) default entity-expansion limit of 64,000 partially mitigates the impact but does not prevent resource exhaustion. This weakness is tracked under [CWE-776] (Improper Restriction of Recursive Entity References in DTDs).

Critical Impact
Authenticated attackers with artifact-write privileges can exhaust CPU and memory resources on Apicurio Registry, causing service unavailability for downstream API consumers.

Affected Products

Apicurio Registry (as tracked in Red Hat CVE-2026-12993 advisory)
Red Hat build of Apicurio Registry (see vendor advisory for affected versions)
Downstream services relying on Apicurio Registry for schema management

Discovery Timeline

2026-06-26 - CVE-2026-12993 published to the National Vulnerability Database (NVD)
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-12993

Vulnerability Analysis

Apicurio Registry accepts XML artifacts through its ingestion APIs. The DocumentBuilderAccessor component constructs a DocumentBuilder instance that parses these submissions. The accessor correctly disables external DTD retrieval and external schema loading, which prevents XML External Entity (XXE) exfiltration attacks. However, the same configuration omits two defensive controls: it does not call setFeature(FEATURE_SECURE_PROCESSING, true) and does not disable DOCTYPE declarations through disallow-doctype-decl.

Because DOCTYPE declarations remain permitted, the parser processes internal entity definitions declared inside the uploaded document. An attacker crafts recursive entity references where each entity expands into multiple references to a lower-level entity. Parsing the document forces the JAXP implementation to allocate memory proportional to the fully expanded string. Sustained uploads consume CPU cycles on parsing threads and drive heap usage upward until the Java Virtual Machine (JVM) triggers garbage collection storms or throws OutOfMemoryError.

Root Cause

The root cause is incomplete hardening of the XML parser factory. Disabling external references without also enabling secure processing leaves internal entity expansion unrestricted beyond the JAXP default cap of 64,000 total expansions. That cap is insufficient to prevent resource exhaustion when attackers submit repeated payloads or nest entities at the boundary of the limit.

Attack Vector

Exploitation requires network access to the Apicurio Registry API and valid credentials with artifact-write scope. The attacker submits a POST request containing an XML artifact whose internal DTD defines nested entities. The registry parses the artifact during validation or storage, consuming resources on the server. No user interaction is required. Repeated submissions amplify the denial-of-service effect and can cascade to dependent services.

A billion-laughs payload is characterized by a chain of entity definitions where each level references the previous entity multiple times, producing exponential string expansion during parsing. Additional technical context is available in the Red Hat CVE-2026-12993 Advisory and the Red Hat Bugzilla Report #2491692.

Detection Methods for CVE-2026-12993

Indicators of Compromise

XML artifact uploads containing <!DOCTYPE> declarations with nested <!ENTITY> definitions referencing themselves multiple times
Sudden JVM heap growth or garbage collection pressure correlated with artifact ingestion requests
Sustained CPU saturation on Apicurio Registry parser threads following authenticated API POST requests
OutOfMemoryError entries in Apicurio Registry application logs during XML processing

Detection Strategies

Inspect artifact submission payloads for internal DTD subsets and reject documents that declare recursive entities
Correlate authenticated API calls that write artifacts with process-level CPU and memory spikes on the registry host
Enable verbose logging on the XML parsing pipeline to capture entity-expansion counts approaching the 64,000 JAXP limit

Monitoring Recommendations

Track heap utilization, garbage collection frequency, and thread CPU time on Apicurio Registry JVM instances
Alert on HTTP 5xx response bursts from artifact-write endpoints, which indicate parser failures
Audit artifact-write role assignments and monitor for unexpected account activity submitting XML content

How to Mitigate CVE-2026-12993

Immediate Actions Required

Restrict artifact-write permissions to trusted service accounts and remove the role from unnecessary users
Deploy a Web Application Firewall (WAF) rule to strip or reject XML payloads containing <!DOCTYPE> declarations before they reach the registry
Apply the vendor patch when available and prioritize registry instances exposed to broad internal networks
Enforce request size limits on artifact ingestion endpoints to cap parser input

Patch Information

Refer to the Red Hat CVE-2026-12993 Advisory for fixed package versions and errata. The remediation enables FEATURE_SECURE_PROCESSING on the DocumentBuilder and disables DOCTYPE declarations through http://apache.org/xml/features/disallow-doctype-decl.

Workarounds

Place Apicurio Registry behind a reverse proxy that rejects XML bodies containing DOCTYPE declarations
Lower the JVM maximum heap allocation to fail fast and preserve host stability under exhaustion attempts
Isolate the registry service on dedicated infrastructure so entity-expansion attacks do not degrade adjacent workloads
Rotate credentials with artifact-write scope and enforce short-lived tokens to reduce the attacker window

bash

# Example reverse proxy filter to reject XML DOCTYPE declarations
# NGINX ModSecurity rule
SecRule REQUEST_BODY "@rx (?i)<!DOCTYPE" \
    "id:1029993,phase:2,deny,status:400,\
    msg:'Blocked XML DOCTYPE declaration (CVE-2026-12993)',\
    tag:'apicurio-registry'"