The Apache XmlSchema walker fails to detect cycles in type derivation, substitution groups, model groups, or attribute groups. A crafted schema containing such a cycle can trigger unlimited recursion, eventually exhausting the call stack and causing a crash. This results in a denial of service for any process that loads the malicious schema, potentially impacting the availability of applications that rely on Apache XMLSchema. The weakness is a classic stack overflow problem, aligning with the CVE’s description of an unbounded recursive walk.

The vulnerability affects the Apache XMLSchema library provided by the Apache Software Foundation. Versions prior to 2.3.3 are susceptible; the advisory explicitly recommends upgrading to 2.3.3 to obtain the fix. No other product or version details are listed in the available data.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating low publicly known exploitation. The CVSS score of 7.5 indicates a high severity level. However, any component that accepts user-supplied XML schemas can be a target; the likely attack vector is that an attacker supplies a malicious schema to the vulnerable walker, causing the recursion to overflow the call stack and interrupt service. The impact is limited to denial of service but can have high operational cost in production environments that need high availability.