Apache XmlSchema does not enforce a limit on how deeply schema definitions can be nested. An attacker can craft a malicious schema that causes the library to recurse until the call stack overflows. This stack overflow aborts the parsing process, effectively stopping the application from functioning and resulting in a denial of service. The flaw is a classic example of uncontrolled recursion (CWE‑674) and can also lead to benign resource exhaustion (CWE‑770).

It affects every installation of the Apache Software Foundation’s Apache XMLSchema library, specifically any release before 2.3.3. The official advisory recommends upgrading to 2.3.3 or later to eliminate the unbounded recursion problem.

The CVSS score is 7.5, indicating a high impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the delivery of a specially crafted XML schema to a process that uses the library; authentication or elevated privileges are not required, so any exposed schema parsing endpoint or integration could be compromised. Exploitation requires only that the attacker supply the crafted schema, making the vulnerability readily exploitable.