CVE-2026-102495, CVE-2026-102496, CVE-2026-102497

Data: 2026-10-06

Severity: High

CVSS Score:

• CVE-2026-102495: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

• CVE-2026-102496: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

• CVE-2026-102497: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Riferimenti:

• CVE-2026-102495:

  • https://nvd.nist.gov/vuln/detail/CVE-2026-102495

  • https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6s

  • https://www.openwall.com/lists/oss-security/2026/09/29/15

• CVE-2026-102496:

  • https://nvd.nist.gov/vuln/detail/CVE-2026-102496

  • https://lists.apache.org/thread/9z1vg8wmvwpfw748fb2nb55w4hgbnxol

  • https://www.openwall.com/lists/oss-security/2026/09/29/16

• CVE-2026-102497:

  • https://nvd.nist.gov/vuln/detail/CVE-2026-102497

  • https://lists.apache.org/thread/1cj02tobjyhjqq723bvg78yxkqt1lk7k

  • https://www.openwall.com/lists/oss-security/2026/09/29/17

Libreria: org.apache.ws.xmlschema:xmlschema-core

• GovWay 3.3.x: <= 2.3.2

• GovWay 3.4.x: <= 2.3.2

Descrizione

1. [CVE-2026-102495] CWE-674: Uncontrolled Recursion

Apache XmlSchema doesn’t limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.

Users are recommended to upgrade to version 2.3.3, which fixes this issue.

2. [CVE-2026-102496] CWE-674: Uncontrolled Recursion

Apache XmlSchema doesn’t limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.

Users are recommended to upgrade to version 2.3.3, which fixes this issue.

3. [CVE-2026-102497] CWE-674: Uncontrolled Recursion

The Apache XmlSchema walker (xmlschema-walker) doesn’t detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service.

Users are recommended to upgrade to version 2.3.3, which fixes this issue.

GovWay

La libreria xmlschema-core è inclusa nella distribuzione di GovWay come dipendenza di Apache CXF e non è utilizzata direttamente dal codice del prodotto: tra i jar distribuiti la referenziano esclusivamente i moduli di CXF.

Per sfruttare le vulnerabilità un attaccante deve far elaborare alla libreria uno schema XML malevolo; in GovWay tale condizione non si verifica per i client del gateway:

• gli endpoint SOAP dell’IntegrationManager esposti tramite CXF costruiscono il proprio modello di servizio a partire dagli schemi generati dalle classi JAXB di GovWay;

• il profilo AS4 elabora il WSDL esposto dal backend Domibus, il cui indirizzo è configurato dall’amministratore;

• la validazione dei contenuti dei messaggi gestiti dal gateway e il caricamento di WSDL e XSD tramite la console non utilizzano Apache XmlSchema.

La vulnerabilità CVE-2026-102497 risiede inoltre nel modulo xmlschema-walker, non distribuito da GovWay.

La libreria viene comunque aggiornata alla prima versione in rilascio.

Versione affette:

• 3.3.x: <= 3.3.20

• 3.4.x: <= 3.4.3

Risoluzione:

• 3.3.x: 3.3.21

• 3.4.x: 3.4.4