A flaw in the Apicurio Registry causes the content-type detection routine to instantiate a SAX parser with unsecured settings, leaving external entity resolution enabled. When an attacker provides a crafted XML document—an upload that is allowed to artifacts—the registry will fetch the external DTD or entity, resulting in blind server-side request forgery (SSRF). Additionally the unchecked entity expansion may trigger a denial-of-service condition by exhausting memory. The primary consequence is SSRF combined with potential DoS, giving attackers external network reach and availability impact.

The vulnerability affects Red Hat’s build of Apicurio Registry 3. No specific sub-versions are listed in the advisory, so any instance running the vulnerable code should be considered at risk; detailed version information is not provided.

The CVSS score of 8.5 ranks the weakness as high severity. Because the EPSS score is not reported, the real likelihood of exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to upload artifacts, so it is limited to users with that permission or an unauthenticated registry that runs with default settings. Once the upload is successful the attack chain is straightforward: an XML file that references an external entity is parsed, leading to a blind SSRF or resource exhaustion attack.