Apache XmlSchema lacks a limit on how deeply schema imports and includes can be nested. A malicious schema that deeply nests imports can cause the parser to recurse until the stack overflows, leading to an application crash and denial of service. This flaw does not directly compromise confidentiality or integrity but can render systems unavailable to legitimate users.

The vulnerability affects all releases of the Apache XMLSchema library distributed by the Apache Software Foundation. Versions earlier than 2.3.3 are impacted, as the upgrade to 2.3.3 contains the fix. No specific sub‑versions beyond that are listed, so all earlier builds of the library should be considered vulnerable.

The flaw is exploitable by supplying a crafted XML schema to any component that loads schemas via the library. Because the CVE data provides a CVSS score of 7.5, the vulnerability is considered high severity. The absence of an EPSS score and lack of a KEV listing suggest it has not been observed widely yet. However, the potential for a stack overflow and a service interruption indicates a high risk if an attacker can control the schema input. The likely attack vector is through a REST or API endpoint that processes XML schemas or an application inadvertently loading untrusted schemas.